ICSA-24-193-16

icsaUScisa_csaf_ot

Siemens SIMATIC WinCC

Advisory ansehen veröffentlicht 2024-07-09

Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens has released new versions for the affected products and recommends to update to the latest versions.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2024-30321US——
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtim…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (12)

  • BehobenSIMATIC PCS 7 V9.1

    Update to V9.1 SP2 UC05 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109812242/
  • BehobenSIMATIC WinCC Runtime Professional V18

    Update to V18 Update 5 or later version

  • BehobenSIMATIC WinCC Runtime Professional V19

    Update to V19 Update 2 or later version

  • BehobenSIMATIC WinCC V7.4

    Update to V7.4 SP1 Update 23 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109955792/
  • BehobenSIMATIC WinCC V7.5

    Update to V7.5 SP2 Update 17 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793460/
  • BehobenSIMATIC WinCC V8.0

    Update to V8.0 Update 5 or later version

  • WorkaroundSIMATIC PCS 7 V9.1

    Restrict access to application webserver for trusted users only

  • WorkaroundSIMATIC WinCC Runtime Professional V18

    Restrict access to application webserver for trusted users only

  • WorkaroundSIMATIC WinCC Runtime Professional V19

    Restrict access to application webserver for trusted users only

  • WorkaroundSIMATIC WinCC V7.4

    Restrict access to application webserver for trusted users only

  • WorkaroundSIMATIC WinCC V7.5

    Restrict access to application webserver for trusted users only

  • WorkaroundSIMATIC WinCC V8.0

    Restrict access to application webserver for trusted users only

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan