Multiple Vulnerabilities in Tableau Server Component of Opcenter Intelligence

An attacker without credentials could gain administrative access to Opcenter Intelligence and execute arbitrary commands on the server, potentially disrupting production monitoring and control of manufacturing operations, or exfiltrating sensitive process data.

Manufacturing facilities using Siemens Opcenter Intelligence for production planning and monitoring, including industries such as automotive, consumer goods, and heavy manufacturing. This affects anyone using Opcenter Intelligence versions before V2501 who rely on it for real-time production data and process control visibility.

An attacker on the network or with network access to Opcenter Intelligence can send malicious requests to the Tableau Server component. By exploiting the authentication bypass (CWE-287), an attacker can access the application without valid credentials. Once inside, they can use path traversal (CWE-22), deserialization attacks (CWE-502), or server-side request forgery (CWE-918) to read sensitive files, execute code, or pivot to internal systems.