SSA-063511: Insufficient protection of key material in WinCC Certificate Manager
WinCC Certificate Manager insufficiently protects key material that could allow an attacker to extract sensitive information. Siemens has released a new version for SIMATIC WinCC Unified PC Runtime V21 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-24349US | — | — | ||
A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V1… | ||||
references
External citations — patches, advisories, analysis.
remediations (12)
- MitigationSIMATIC WinCC Unified PC Runtime V16
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- MitigationSIMATIC WinCC Unified PC Runtime V17
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- MitigationSIMATIC WinCC Unified PC Runtime V18
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- MitigationSIMATIC WinCC Unified PC Runtime V19
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- MitigationSIMATIC WinCC Unified PC Runtime V20
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- MitigationSIMATIC WinCC Unified PC Runtime V21
The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.
- No fix plannedSIMATIC WinCC Unified PC Runtime V16
Currently no fix is planned
- No fix plannedSIMATIC WinCC Unified PC Runtime V17
Currently no fix is planned
- No fix plannedSIMATIC WinCC Unified PC Runtime V18
Currently no fix is planned
- No fix plannedSIMATIC WinCC Unified PC Runtime V19
Currently no fix is planned
- No fix plannedSIMATIC WinCC Unified PC Runtime V20
Currently no fix is planned
- FixedSIMATIC WinCC Unified PC Runtime V21
Update to V21 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109991140/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan