Siemens WinCC Unified PC Runtime Key Material Protection Vulnerability

A vulnerability exists in all versions of SIMATIC WinCC Unified PC Runtime from V16 to V21 (excluding V21 Update 2), due to inadequate protection of key material in the WinCC Certificate Manager. This flaw could enable an attacker to extract sensitive information.

Impact

Exploitation of this vulnerability could lead to the extraction of sensitive information by allowing access to poorly protected key material.

Remediation

Siemens has released a new version for SIMATIC WinCC Unified PC Runtime V21 and recommends updating to the latest version. For products where fixes are not yet available, Siemens advises following specific countermeasures outlined in the Siemens Security Advisory SSA-063511.