Siemens Opcenter Quality SmartClient Modules LDAP Communication Vulnerability

A vulnerability exists in Siemens Opcenter Quality SmartClient modules, specifically in Opcenter QL Home (SC), SOA Audit, and SOA Cockpit, all versions from 13.2 up to 2506. The issue arises because these applications do not, by default, encrypt communications over the LDAP interface. This lack of encryption could enable an authenticated attacker to access sensitive information without authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information via the unencrypted LDAP communication.

Remediation

Users are advised to enable secure protocols on the LDAP interface by activating the SSL flag in the configuration and properly setting up the TLS configuration. Additionally, all users, including those in LDAP, should be granted only the minimum necessary privileges.