Siemens SIMATIC WinCC Unified PC Runtime V16
At a glance
- Source
- NVD
- EPSS
- EPSS 0.06 % · percentile 0 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Analyzed
Description
A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.
Weaknesses (CWE)
- CWE-313 — Cleartext Storage in a File or on Disk
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | siemens |
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | siemens |
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | NVD · productcert@siemens.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-35382
- GCVE · GCVE-0-2026-24349
CERT-FR advisories
- CERTFR-2026-AVI-0714 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:*:*:*:*:*:*:*:*≥ 16 ≤ 20cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:21:-:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:21:update1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Siemens · SIMATIC WinCC Unified PC Runtime V16 | affected 0 < * |
| Siemens · SIMATIC WinCC Unified PC Runtime V17 | affected 0 < * |
| Siemens · SIMATIC WinCC Unified PC Runtime V18 | affected 0 < * |
| Siemens · SIMATIC WinCC Unified PC Runtime V19 | affected 0 < * |
| Siemens · SIMATIC WinCC Unified PC Runtime V20 | affected 0 < * |
| Siemens · SIMATIC WinCC Unified PC Runtime V21 | affected 0 < V21 Update 2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |