CVE-2024-30321

mediumPriorität · verfolgen · 0EPSS 0.005 · 44. PerzentilDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.51% (44th) EPSS

CVSS 5.9 · medium

Is it mine?

30 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP2 UC05 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
BehobenSIMATIC WinCC Runtime Professional V18siemens_psirt
Update to V18 Update 5 or later version
BehobenSIMATIC WinCC Runtime Professional V19siemens_psirt
Update to V19 Update 2 or later version
BehobenSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 23 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955792/
BehobenSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
BehobenSIMATIC WinCC V8.0siemens_psirt
Update to V8.0 Update 5 or later version
BehobenSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP2 UC05 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
BehobenSIMATIC WinCC Runtime Professional V18cisa_csaf_ot
Update to V18 Update 5 or later version
BehobenSIMATIC WinCC Runtime Professional V19cisa_csaf_ot
Update to V19 Update 2 or later version
BehobenSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 23 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955792/
BehobenSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
BehobenSIMATIC WinCC V8.0cisa_csaf_ot
Update to V8.0 Update 5 or later version
WorkaroundSIMATIC PCS 7 V9.1siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC Runtime Professional V18siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC Runtime Professional V19siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V7.4siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V7.5siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V8.0siemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC PCS 7 V9.1cisa_csaf_ot
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC Runtime Professional V18cisa_csaf_ot
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC Runtime Professional V19cisa_csaf_ot
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V7.4cisa_csaf_ot
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V7.5cisa_csaf_ot
Restrict access to application webserver for trusted users only
WorkaroundSIMATIC WinCC V8.0cisa_csaf_ot
Restrict access to application webserver for trusted users only

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–8.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · productcert@siemens.com DEAusnutzbarkeit 2.2 · Auswirkung 3.6

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Siemens ProductCERT DE

v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · CISA US

v4.08.2highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.08.2highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.04.6mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-359USCWE-359USCWE-359USCWE-359USCWE-359US

betroffene Produkte (30)

Betroffene Produkte und Versionsbereiche.

SIMATIC PCS 7 V9.1alle Versionencisa_csaf_otUS
SIMATIC WinCC Runtime Professional V18alle Versionencisa_csaf_otUS
SIMATIC WinCC Runtime Professional V19alle Versionencisa_csaf_otUS
SIMATIC WinCC V7.4alle Versionencisa_csaf_otUS
SIMATIC WinCC V7.5alle Versionencisa_csaf_otUS
SIMATIC WinCC V8.0alle Versionencisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.1< V9.1_SP2_UC05cisa_csaf_otUS
Siemens SIMATIC WinCC Runtime Professional V18< V18_Update_5cisa_csaf_otUS
Siemens SIMATIC WinCC Runtime Professional V19< V19_Update_2cisa_csaf_otUS
Siemens SIMATIC WinCC V7.4< V7.4_SP1_Update_23cisa_csaf_otUS
Siemens SIMATIC WinCC V7.5< V7.5_SP2_Update_17cisa_csaf_otUS
Siemens SIMATIC WinCC V8.0< V8.0_Update_5cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.10 → V9.1 SP2 UC05enisa_euvdEU
Siemens SIMATIC WinCC Runtime Professional V180 → V18 Update 5enisa_euvdEU
Siemens SIMATIC WinCC Runtime Professional V190 → V19 Update 2enisa_euvdEU
Siemens SIMATIC WinCC V7.40 → V7.4 SP1 Update 23enisa_euvdEU
Siemens SIMATIC WinCC V7.50 → V7.5 SP2 Update 17enisa_euvdEU
Siemens SIMATIC WinCC V8.00 → V8.0 Update 5enisa_euvdEU
Siemens AG SIMATIC PCS 7≤ 9.1fstec_bduRU
Siemens AG SIMATIC WinCC7.4 → 7.4 SP1 Update 23fstec_bduRU

20 von 30 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2024-0282Kwetsbaarheden verholpen in Siemens ProductenNL2024-07-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.
SSA-883918SSA-883918: Information Disclosure Vulnerability in SIMATIC WinCC2024-07-09csaf · siemens_psirtDE
Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens has released new versions for the affected products and recommends to update to the latest versions.
WID-SEC-W-2024-1576Siemens SIMATIC WinCC: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2024-07-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Siemens SIMATIC WinCC ausnutzen, um Informationen offenzulegen.
ICSA-24-193-16Siemens SIMATIC WinCC2024-07-09icsa · cisa_csaf_otUS
Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens has released new versions for the affected products and recommends to update to the latest versions.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl siemens_psirt cert_bund NVD CVE.org MITRE

veröffentlicht 2024-07-09geändert 2026-06-17

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan