Read the docs
TI-2024-20058 Aliases CVE-2024-30321GHSA-x843-fv8x-w437

A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05)…

Priority LOW 38CWE-359Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-359.

Summary

A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed SIMATIC PCS 7 V9.1 (Siemens): V9.1 SP2 UC05SIMATIC WinCC Runtime Professional V18 (Siemens): V18 Update 5+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC PCS 7 V9.1before V9.1 SP2 UC05V9.1 SP2 UC05Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V18before V18 Update 5V18 Update 5Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V19before V19 Update 2V19 Update 2Patch availableCNA
SiemensSIMATIC WinCC V7.4before V7.4 SP1 Update 23V7.4 SP1 Update 23Patch availableCNA
SiemensSIMATIC WinCC V7.5before V7.5 SP2 Update 17V7.5 SP2 Update 17Patch availableCNA
SiemensSIMATIC WinCC V8.0before V8.0 Update 5V8.0 Update 5Patch availableCNA
  • SIMATIC PCS 7 V9.1 VendorSiemens Affected before V9.1 SP2 UC05 Fixed in V9.1 SP2 UC05 Patch available CNA
  • SIMATIC WinCC Runtime Professional V18 VendorSiemens Affected before V18 Update 5 Fixed in V18 Update 5 Patch available CNA
  • SIMATIC WinCC Runtime Professional V19 VendorSiemens Affected before V19 Update 2 Fixed in V19 Update 2 Patch available CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected before V7.4 SP1 Update 23 Fixed in V7.4 SP1 Update 23 Patch available CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected before V7.5 SP2 Update 17 Fixed in V7.5 SP2 Update 17 Patch available CNA
  • SIMATIC WinCC V8.0 VendorSiemens Affected before V8.0 Update 5 Fixed in V8.0 Update 5 Patch available CNA

CPE names CISA-ADP · 3

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA SIMATIC PCS 7 V9.1 (Siemens) Fixed in V9.1 SP2 UC05
  • Fix · CNA SIMATIC WinCC Runtime Professional V18 (Siemens) Fixed in V18 Update 5
  • Fix · CNA SIMATIC WinCC Runtime Professional V19 (Siemens) Fixed in V19 Update 2
  • Fix · CNA SIMATIC WinCC V7.4 (Siemens) Fixed in V7.4 SP1 Update 23
  • Fix · CNA SIMATIC WinCC V7.5 (Siemens) Fixed in V7.5 SP2 Update 17
  • Fix · CNA SIMATIC WinCC V8.0 (Siemens) Fixed in V8.0 Update 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-30321
  2. 2026-10-03 Alias added: GHSA-x843-fv8x-w437

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences