Sensitive Information Disclosure in SIMATIC PCS neo Administration Console

An attacker with local access to the Administration Console system could steal Windows admin credentials and use them to compromise other systems on your network, potentially gaining control over engineering workstations or other critical IT infrastructure connected to your industrial control system.

Engineering teams using SIMATIC PCS neo Administration Console for process automation configuration and monitoring. This affects anyone managing PCS neo-based systems in manufacturing, utilities, or other industrial facilities where the Administration Console runs on Windows workstations or servers connected to corporate networks.

An attacker with local Windows access to the Administration Console machine (either physical access or via Remote Desktop/similar) can extract stored admin credentials from memory, configuration files, or the application. These credentials can then be reused to authenticate to other Windows systems on the network with administrative privileges.