SSA-883918: Information Disclosure Vulnerability in SIMATIC WinCC
Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-30321US | — | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtim… | ||||
references
External citations — patches, advisories, analysis.
remediations (12)
- FixedSIMATIC PCS 7 V9.1
Update to V9.1 SP2 UC05 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/ - FixedSIMATIC WinCC Runtime Professional V18
Update to V18 Update 5 or later version
- FixedSIMATIC WinCC Runtime Professional V19
Update to V19 Update 2 or later version
- FixedSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 23 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955792/ - FixedSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - FixedSIMATIC WinCC V8.0
Update to V8.0 Update 5 or later version
- WorkaroundSIMATIC PCS 7 V9.1
Restrict access to application webserver for trusted users only
- WorkaroundSIMATIC WinCC Runtime Professional V18
Restrict access to application webserver for trusted users only
- WorkaroundSIMATIC WinCC Runtime Professional V19
Restrict access to application webserver for trusted users only
- WorkaroundSIMATIC WinCC V7.4
Restrict access to application webserver for trusted users only
- WorkaroundSIMATIC WinCC V7.5
Restrict access to application webserver for trusted users only
- WorkaroundSIMATIC WinCC V8.0
Restrict access to application webserver for trusted users only
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan