Machine-generated analysis · WAYSCloud LLM
The advisory states that WinCC Certificate Manager stores key material with insufficient protection, potentially allowing extraction of sensitive information.
Context
The affected product is Siemens WinCC Certificate Manager, part of the SIMATIC WinCC Unified PC Runtime. The advisory states that affected versions store key material insecurely, which could allow an attacker to extract sensitive information. This issue affects all versions prior to V21.0.2, including V16 through V20. The advisory notes that Siemens has released a new version to address the issue and recommends updating to the latest version where possible.
Operator considerations
Check: inventory SIMATIC WinCC Unified PC Runtime installations for versions prior to V21.0.2
WinCC Certificate Manager insufficiently protects key material that could allow an attacker to extract sensitive information. Siemens has released a new version for SIMATIC WinCC Unified PC Runtime V21 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Read the full advisory on CISA →