CVE-2026-24349

EUVD-2026-35382

09.06.2026, 10:16

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
siemens	simatic_wincc_unified_pc_runtime	16 ≤ 𝑥 ≤ 20

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-313 - Cleartext Storage in a File or on Disk
The application stores sensitive information in cleartext in a file, or on disk.

References

https://cert-portal.siemens.com/productcert/html/ssa-063511.html