CVE-2024-30321 MEDIUM

CVE-2024-30321

Vendor Siemens
Product SIMATIC PCS 7 V9.1
Weakness CWE-359
Published July 9, 2024
Last update August 27, 2025
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.

Key dates

02Disclosure timeline

July 9, 2024 CVE published
August 27, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-45720 HCL Leap is affected by a disclosure of private personal information vulnerability CVE-2022-1365 Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch CVE-2023-36052 Azure CLI REST Command Information Disclosure Vulnerability CVE-2026-57960 Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id CVE-2024-42347 URL preview setting for a room is controllable by the homeserver in matrix-react-sdk