• CVE-2024-41979:
• Remove all tools giving possibility to call SOAP-services outside from the SmartClient
• The hardening instructions mentioned in the products security concept should be followed
• The SmartClient should be operated in a secured network and context only
• CVE-2024-41980:
• All the users (including in LDAP) should be given the least privileges required
• Harden LDAP-interface secure protocols by enabling the SSL-flag on configuration and a proper setup of your TLS-configuration
• CVE-2024-41982: Limit the permission to access those fields using the least privilege strategy
• CVE-2024-41983:
• Do not use original table structures and accounts for reporting. Create your own reporting accounts which have access via synonyms forwarding on views representing access to result-sets the user may use for evaluation
• Harden your IIS
• Limit the information to prevent to the end-user based on the need-to-know-principle to the minimum possible information
• Prevent any scanning of structures and configurations
• Use DB-tools to limit load on productive systems for reporting accounts or use offline systems for reporting
• CVE-2024-41984:
• Hardening of the solution, including the OS and IIS, is required, with specific measures such as hiding the IIS version to enhance security
• Users should not have the possibility to scan folders and extensions of files allowed to open should be limited to the required one
• CVE-2024-41986:
• Disable all protocols (SSL v2/v3, TLS 1.0, TLS 1.1) the solution should not use.
• Ensure, TLS 1.2 is enabled if you plan to use TLS 1.2.
• Follow the instructions of the security concept of Opcenter Quality and vendors.

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.