Description
A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation folder if a non-default installation path was chosen during installation.
This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC WinCC | All versions < V7.5.2.13 | — |
Advisories 3
- ICSA-23-166-07 Siemens SIMATIC WinCC V7 CISA ICS & IT advisories · May 6, 2025
- SSA-914026 SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7 Siemens ProductCERT · Jun 13, 2023
- WID-SEC-2023-1427 Siemens SIMATIC WinCC: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 12, 2023