Argument Injection Vulnerability in SIMATIC WinCC OA Ultralight Client

An attacker with valid credentials could inject parameters to launch unauthorized panels or scripts on the Ultralight Client, potentially allowing them to view sensitive configuration data, alter operational parameters, or execute control logic without proper authorization.

Organizations running SIMATIC WinCC OA visualization and SCADA systems should prioritize this. Operators of water treatment facilities, electric utilities, chemical plants, and other critical infrastructure using WinCC OA as a supervisory control system are affected. Particularly relevant are systems where the Ultralight Client (web-based remote access) is exposed to untrusted networks or where multiple users with different privilege levels share the same credentials.

An attacker with valid WinCC OA credentials crafts a malicious URL or request to the web interface when launching the Ultralight Client, injecting arbitrary parameters into the startup arguments. These injected parameters could specify attacker-chosen panels to open or control scripts to execute, bypassing normal access controls.