CVE-2024-41980 Details
Description
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application do not encrypt the communication in LDAP interface by default. This could allow an authenticated attacker to gain unauthorized access to sensitive information.
A vulnerability exists in Siemens Opcenter Quality SmartClient modules, specifically in Opcenter QL Home (SC), SOA Audit, and SOA Cockpit, all versions from 13.2 up to 2506. The issue arises because these applications do not, by default, encrypt communications over the LDAP interface. This lack of encryption could enable an authenticated attacker to access sensitive information without authorization.
Users are advised to enable secure protocols on the LDAP interface by activating the SSL flag in the configuration and properly setting up the TLS configuration. Additionally, all users, including those in LDAP, should be granted only the minimum necessary privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-382999.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-311 | Missing Encryption of Sensitive Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| siemens opcenter quality | 13.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2025 | Initial Analysis | [email protected] |
| Aug 12, 2025 | New CVE Received | [email protected] |