CVE-2024-30321
Reported by siemens · Published July 9, 2024
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| SIMATIC WinCC Runtime Professional V19 | Siemens | V19 Update 2 |
| SIMATIC PCS 7 V9.1 | Siemens | V9.1 SP2 UC05 |
| SIMATIC WinCC V8.0 | Siemens | V8.0 Update 5 |
| SIMATIC WinCC V7.5 | Siemens | V7.5 SP2 Update 17 |
| simatic_pcs_7 | siemens | 10 |
| simatic_wincc_runtime_professional | siemens | 19_update_2, 19 |
| SIMATIC WinCC V7.4 | Siemens | V7.4 SP1 Update 23 |
| simatic_wincc | siemens | 8.0_update_5, 7.5_sp2_update_17, 7.4_sp1_update_23 |
| SIMATIC WinCC Runtime Professional V18 | Siemens | V18 Update 5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC PCS 7 V9.1 | 0 |
| Siemens | SIMATIC WinCC Runtime Professional V18 | 0 |
| Siemens | SIMATIC WinCC Runtime Professional V19 | 0 |
| Siemens | SIMATIC WinCC V7.4 | 0 |
| Siemens | SIMATIC WinCC V7.5 | 0 |
| Siemens | SIMATIC WinCC V8.0 | 0 |
| Siemens | SIMATIC WinCC Runtime Professional V19 | 0 |
| Siemens | SIMATIC PCS 7 V9.1 | 0 |
| Siemens | SIMATIC WinCC V8.0 | 0 |
| Siemens | SIMATIC WinCC V7.5 | 0 |
| siemens | simatic_pcs_7 | 9.1 |
| siemens | simatic_wincc_runtime_professional | 19, 18 |
| Siemens | SIMATIC WinCC V7.4 | 0 |
| siemens | simatic_wincc | 7.4, 7.5, 8.0 |
| Siemens | SIMATIC WinCC Runtime Professional V18 | 0 |
Timeline
- Jul 9, 2024 CVE Published
- Jul 10, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (8 in total, the first dated here)
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-30321
vulnetix vdb fixes CVE-2024-30321Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-30321/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart