SSA-550198: Authenticated Remote Code Execution in WinCC
Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59241DE | high8.8 | — | ||
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- Kein Fix verfügbarSIMATIC WinCC V7.5
Currently no fix is available
- BehobenSIMATIC WinCC V8.0
Update to V8.0 Update 11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818723/ - BehobenSIMATIC WinCC V8.1
Update to V8.1 Update 7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977191/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan