CVE-2026-24349CWE-313

CVE-2026-24349

High · published June 9, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
0.0
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00057 · 0.0th percentile
Weakness
CWE-313 · Cleartext Storage in a File or on Disk
Published
2026-06-09T14:16Z
Affected products (3)
ProductVersionsFixed in
siemens/simatic_wincc_unified_pc_runtime≥ 16, ≤ 20—
siemens/simatic_wincc_unified_pc_runtimeall versions—
siemens/simatic_wincc_unified_pc_runtimeall versions—
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-063511.html · [email protected]
EPSS history
Timeline
  • 09 JUN 08:46Z
    A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC…
    cvelistv5