Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products

An attacker with local administrative access to a WinCC OA server or PDM Maintenance Station could gain unrestricted control of that system, potentially enabling them to alter process configurations, modify setpoints, disable alarms, or interfere with remote communications to field devices.

Manufacturing facilities, water treatment plants, and power utilities using Siemens SIMATIC WinCC OA (versions 3.18, 3.19, 3.20) for SCADA/HMI operations or SIMATIC PDM Maintenance Station for field device management. Any organization with engineering workstations or centralized automation servers running these products is at risk if local access controls are not strictly enforced.

An attacker must first gain local access to the engineering workstation or automation server (physical access or prior compromise). With administrative or high-privilege credentials already obtained, the attacker exploits the CodeMeter Runtime flaw to escalate to full system control, bypassing any remaining access restrictions. Once compromised, the attacker can manipulate HMI/SCADA configurations, modify controller logic, or deny service to operators.