Siemens WinCC key-material exposure affects industrial HMI
WinCC Certificate Manager stores cryptographic keys insecurely, enabling extraction of sensitive material across multiple SIMATIC runtime versions.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Siemens has disclosed CVE-2026-24349, an insufficient protection vulnerability in the WinCC Certificate Manager component of SIMATIC WinCC Unified PC Runtime. The flaw allows attackers to extract sensitive key material stored in cleartext, potentially compromising cryptographic operations in industrial human-machine interface (HMI) systems. Affected versions span V16 through V20 (all versions) and V21 prior to update 2.
Siemens has released V21 Update 2 as a fix for the latest runtime version, but no patches are planned for V16-V20. The vulnerability impacts critical infrastructure sectors including manufacturing, energy, transportation, healthcare, and government facilities worldwide. CISA and Siemens recommend network segmentation, restricting device access, and operating affected systems only in protected IT environments per Siemens operational guidelines for Industrial Security.
The disclosure follows coordinated reporting by Siemens ProductCERT to CISA. Organizations running affected versions should prioritize the V21 update where feasible and implement compensating controls—such as isolating WinCC systems behind firewalls and limiting physical/logical access—for legacy versions where patches are unavailable.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs