The vulnerability is insufficient protection of key material in the WinCC Certificate Manager, a component of Siemens SIMATIC WinCC Unified PC Runtime. Classified as CWE‑313, it allows an attacker to retrieve sensitive information such as cryptographic keys, which could be used to decrypt data or hijack control system communications.

Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V20, and V21 prior to Update 2, are affected. These runtimes are widely used in industrial control systems, making the issue relevant to critical infrastructure operators.

The CVSS score of 8.2 indicates high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalogue, though that does not diminish the risk of exploitation. The attack vector is not explicitly stated, but it is inferred that an attacker with local or network access could leverage the weak protection to read the stored keys. Operators should treat this as a significant threat, especially if the runtime is exposed to untrusted networks.