Medium severity · published Jul 9, 2024
CVE-2024-30321
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC…
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information.
This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
SIMATIC PCS 7 V9.1 · Siemens
before V9.1 SP2 UC05 · source: vendor
SW
SIMATIC WinCC Runtime Professional V18 · Siemens
before V18 Update 5 · source: vendor
SW
SIMATIC WinCC Runtime Professional V19 · Siemens
before V19 Update 2 · source: vendor
SW
SIMATIC WinCC V7.4 · Siemens
before V7.4 SP1 Update 23 · source: vendor
SW
SIMATIC WinCC V7.5 · Siemens
before V7.5 SP2 Update 17 · source: vendor
SW
SIMATIC WinCC V8.0 · Siemens
before V8.0 Update 5 · source: vendor
SP
Simatic Pcs 7 · Siemens
9.1 before 10 · source: CISA
SW
Simatic Wincc · Siemens
7.4 before 7.4_sp1_update_23; 7.5 before 7.5_sp2_update_17; 8.0 before 8.0_update_5; 7.4 before 7.4_sp1_update_23; 7.5 before 7.5_sp2_update_17; 8.0 before 8.0_update_5; +3 more · source: CISA
SW
Simatic Wincc Runtime Professional · Siemens
18 before 19; 19 before 19_update_2; 18 before 19; 19 before 19_update_2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30321
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-883918.html
More from SIMATIC PCS 7 V9.1
9.1
CVE-2024-35783
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All…
6.5
CVE-2023-46280
A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1…
6.2
CVE-2023-50821
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC…