CVE-2026-24349

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24349
A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-063511.html Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:21:-:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:21:update1:*:*:*:*:*:*
History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary (es) Una vulnerabilidad ha sido identificada en SIMATIC WinCC Unified PC Runtime V16 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V17 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V18 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V19 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V20 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V21 (Todas las versiones < V21 Update 2). Protección insuficiente del material clave en WinCC Certificate Manager que podría permitir a un atacante extraer información sensible. (es) Una vulnerabilidad ha sido identificada en SIMATIC WinCC Unified PC Runtime V16 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V17 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V18 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V19 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V20 (Todas las versiones), SIMATIC WinCC Unified PC Runtime V21 (Todas las versiones anteriores a V21 Update 2). Protección insuficiente del material clave en WinCC Certificate Manager que podría permitir a un atacante extraer información sensible.
Information

Published : 2026-06-09 10:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-24349

Mitre link : CVE-2026-24349

CVE.ORG link : CVE-2026-24349

JSON object : View

Products Affected

siemens

  • simatic_wincc_unified_pc_runtime
CWE
CWE-313

Cleartext Storage in a File or on Disk