Multiple serious vulnerabilities have been found in Siemens Simatic WinCC. Malicious users can exploit these vulnerabilities to gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities

1. An unsafe encryption key can be exploited remotely via key extraction;
2. Weak system-object access control can be exploited locally;
3. Vectors related to the WebNavigator server and other unspecified vectors can be exploited via specially designed requests.

Siemens Simatic WinCC versions earlier than 7.3

Update to latest version

Siemens bulletin