CVE-2024-44102 Deserialization in PP TeleControl Server Basic 1000 to 5000 V3.1

What is CVE-2024-44102?

CVE-2024-44102 is a critical unsafe deserialization vulnerability in Siemens Telecontrol Server Basic, published on 12 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 256 to 1000 V3.1 (6NH9910-0AA31-0AD1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 32 to 64 V3.1 (6NH9910-0AA31-0AF1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 64 to 256 V3.1 (6NH9910-0AA31-0AC1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 8 to 32 V3.1 (6NH9910-0AA31-0AB1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 1000 V3.1 (6NH9910-0AA31-0AD0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 256 V3.1 (6NH9910-0AA31-0AC0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 32 V3.1 (6NH9910-0AA31-0AF0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 5000 V3.1 (6NH9910-0AA31-0AE0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 64 V3.1 (6NH9910-0AA31-0AB0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 8 V3.1 (6NH9910-0AA31-0AA0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Serv Upgr (6NH9910-0AA31-0GA1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Upgr V3.1 (6NH9910-0AA31-0GA0) (All versions < V3.1.2.1 with redundancy configured). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Weakness: CWE-502

Which versions are affected by CVE-2024-44102?

It affects 1 product.

Products include Siemens Telecontrol Server Basic.

How do I fix CVE-2024-44102?

No fix has been published for CVE-2024-44102 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2024-44102 being exploited?

There is no known exploitation of CVE-2024-44102 in the wild and no public exploit code.

Other vulnerabilities in Siemens Telecontrol Server Basic

• CVE-2025-40765 Information disclosure in TeleControl Server Basic V3.1 Critical 9.3
• CVE-2025-27495 SQL injection in TeleControl Server Basic Critical 9.3
• CVE-2025-27539 SQL injection in TeleControl Server Basic Critical 9.3
• CVE-2025-27540 SQL injection in TeleControl Server Basic Critical 9.3
• CVE-2018-4836 Privilege escalation in TeleControl Server Basic High 8.8

All Siemens Telecontrol Server Basic vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-57qc-q8rc-w8h7.