Dashboard / CVE-2026-24349

CVE-2026-24349

HIGH
MEDIUM Priority: 0.00 BB Relevance: 51/100
Published: 2026-06-09 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
siemens simatic_wincc_unified_pc_runtime 16 – 20
siemens simatic_wincc_unified_pc_runtime 21
siemens simatic_wincc_unified_pc_runtime 21

References & Advisories (1)

Bug Bounty Relevance

51 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.06%
Raw Score 0.000570
Percentile 0.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00057
2026-10-28
0.00057

Intelligence Sources

nvd ref →

External Links