Resolving PASCC Web Navigator Authorization on WinCC 6.2 SP2

Problem Description

When deploying a SICAM PAS CC (Power Automation System Control Center) 6.0x runtime on a SIMATIC WinCC 6.2 SP2 server with WinCC WebNavigator clients, operators authenticated through the WinCC user administration can still issue control commands to PAS CC technology objects (circuit-breakers, disconnectors, earth switches, transformer tap-changers) even when their user rights have been explicitly configured to deny control operations.

The defect has the following characteristics in the field:

• Native WinCC graphical objects honor the configured user authorization correctly on both the server's local clients and the WebNavigator clients.
• Classical (non-Web) WinCC clients on the same project respect the user-administration rules for PAS CC objects.
• Only the WebNavigator client path bypasses the WinCC user authorization when targeting PAS CC objects whose faceplate scripts have not been adjusted by Siemens Customer Care.
• The bypass exists regardless of whether the WebNavigator client runs WinCC 6.2 SP2 or WinCC 6.2 SP3.

Affected Software Versions and Components

The condition is reproducible with the following officially tested and supported combination, as documented in the SICAM SCC manual:

Cross-version combinations are not supported. Using a WinCC 6.2 SP2 server with WebNavigator 6.2 SP3 (or any other mismatch) is not covered by Siemens support and the control-authorization issue will persist.

Root Cause Analysis

PAS CC objects are inserted into WinCC pictures as customized ActiveX / OCX faceplates that ship with the SICAM PAS CC installation. The runtime behavior of these faceplates is driven by C-script and VBS actions that invoke the PAS CC API directly, rather than going through the WinCC user-administration hooks used by native WinCC controls.

Two separate defects combine to create the bypass:

1. Default faceplate script — the un-modified PAS CC faceplate script does not query the WinCC user-administration permission bits before issuing the control command to the PAS CC backend.
2. Optional WebNavigator plug-in — the "Basic Process Control" ActiveX plug-in is offered to the WebNavigator client during the initial plug-in download but is not a hard installation requirement. If a client declines or skips the plug-in install, the secondary client-side authorization check is absent and the control command reaches the PAS CC backend unrestricted.

For native WinCC objects the user-administration check happens inside the WinCC runtime on the server itself, so the WebNavigator client only receives a view. PAS CC faceplates were originally authored to assume the basic-process-control plug-in was present on the client and that the plug-in would perform the secondary authorization check. When the plug-in is absent, the check is skipped entirely.

The defect is not a runtime race condition — it is a static design gap in the original PAS CC faceplate scripts, and it requires both a server-side script change and a client-side plug-in presence to close fully.

Required Hotfix Levels

WinCC 6.2 SP2 ships with a set of post-release hotfixes numbered HF1 through HF8 (and beyond) that bundle stability fixes, security patches, and revised plug-in installers for the WebNavigator. Hotfix 8 (HF8) is the level that includes the corrected PAS CC installation image and updated WebNavigator installation files. The HF8 package can be requested from Siemens Energy customer support at [email protected], indicating the WinCC, WebNavigator, and PAS CC versions in the project.

Apply the hotfix in this order:

1. Stop the WinCC Runtime on the server.
2. Stop the WinCC WebNavigator service.
3. Install WinCC 6.2 SP2 HF8 on the WinCC server.
4. Install WebNavigator 6.2 SP2 HF8 on the same server (it shares the WinCC installation).
5. Reboot the server.
6. Restart WinCC Runtime and the WebNavigator service.
7. Verify in WinCC Explorer — Help > About — that both components report Hotfix 8.

Basic Process Control Plugin Installation

The "Basic Process Control" plug-in is delivered as part of the WinCC 6.2 SP2 WebNavigator client installation. When a user first connects to the WebNavigator server from Internet Explorer, the WebNavigator control downloads a small installer that offers the following optional components:

• WinCC Basic Process Control plug-in (ActiveX)
• WinCC SmartTools
• Various technology plug-ins (PCS 7, PAS CC, ...)

The Basic Process Control plug-in is required on every WebNavigator client that opens PAS CC faceplates. It enforces the WinCC user-administration permission bits on the client side before the control command is forwarded to the server. When the plug-in is installed, an operator without control rights sees the faceplate in a read-only state and cannot issue an open/close command.

To install the plug-in from the WebNavigator client:

1. Open Internet Explorer and navigate to the WebNavigator server URL (typically http://<server>/WebNavigator/).
2. Sign in with a valid WinCC user account.
3. When prompted by the ActiveX control, accept the download of the WebNavigator client installer.
4. In the Download / Install WinCC / WebNavigator Custom Plug-ins dialog, check the box for Basic Process Control and any other PAS CC plug-ins used by the project.
5. Complete the installation. A restart of Internet Explorer is required.

PDL File Modification for PAS CC Objects

In addition to the client-side plug-in enforcement, Siemens Customer Care provides modified picture (.pdl) files for the PAS CC technology objects such as circuit-breakers. These modified PDL files contain the updated C-script and VBS actions that consult the WinCC user-administration permission before invoking the PAS CC control API. This is the server-side authorization check that closes the bypass even if a client connects without the Basic Process Control plug-in installed.

To obtain the modified PDL files:

1. Open a support ticket with [email protected].
2. Provide the WinCC version, WebNavigator version, PAS CC version (including service pack), and a list of PAS CC object types in the project (CB, disconnector, earth switch, transformer tap-changer, etc.).
3. Siemens Customer Care returns a ZIP archive of modified PDL files and an installation note.
4. Back up the existing GraCS directory of the WinCC project.
5. Copy the modified PDL files into the WinCC project's GraCS folder, overwriting the originals.
6. Recompile the OS server and reload the runtime.
7. Have all WebNavigator clients close and re-open their browser sessions so the modified faceplates are re-cached.

Step-by-Step Resolution Procedure

Apply the four-part remedy in this sequence; skipping a step leaves the bypass open:

1. Align WinCC / WebNavigator versions. Install WinCC 6.2 SP2 + Hotfix 8 on the server. Confirm the WebNavigator is also at 6.2 SP2 + Hotfix 8. Do not run mixed SP / HF levels.
2. Install PAS CC Service Pack 4. Apply SicamPas 6.0 SP4 on the WinCC server (or the PAS CC station). SP4 is the officially tested level for the WebNavigator + PAS CC runtime combination.
3. Install the Basic Process Control plug-in on every WebNavigator client. Pre-deploy the plug-in via the WebNavigator "Download / Install WinCC / WebNavigator Custom Plug-ins" dialog or via a managed installation image. Verify presence on each client before granting WebNavigator access.
4. Replace the PAS CC faceplate PDL files. Insert the modified PDL files from Siemens Customer Care into the WinCC project GraCS folder, back up the originals first, then recompile the OS server.

Verification Checklist

After applying the remedy, perform the following checks from a WebNavigator client using an account that has no control rights assigned:

Check the WinCC "WebNavigator" diagnostic page on the server for active plug-in versions reported by each connecting client. Mismatched or missing plug-in versions indicate a client that did not run the latest installer.

Configuration Parameters and Permissions

WinCC user administration stores permissions in the User Administrator plug-in of WinCC Explorer. PAS CC uses two authorization levels that must be assigned in the OS project editor:

Assign each user the lowest possible authorization set. The Basic Process Control plug-in on the WebNavigator client checks these authorization numbers before forwarding a control command. Configure the authorization numbers consistently across all OS servers in a redundant pair; otherwise a user may be denied on the master server and accepted on the standby.

Client-Side Hardening Recommendations

Because the Basic Process Control plug-in is presented as an optional install by the default WebNavigator client bootstrap, treat the plug-in as a mandatory deployment artifact in production:

• MSI push: Extract the plug-in installer from the WinCC 6.2 SP2 HF8 installation media and deploy it through Group Policy or SCCM to every WebNavigator client workstation.
• Add the WebNavigator server to the Local Intranet zone in Internet Explorer so the ActiveX prompt is trusted and the plug-in download is not blocked by the default Internet zone policy.
• Whitelist the WebNavigator site in any pop-up blocker or script-blocking add-on in use on the engineering workstations.
• Configure anti-virus exclusions for the Internet Explorer temporary-internet-files folder so the plug-in ActiveX is not quarantined on first download.
• Pin the plug-in version and prevent automatic IE version upgrades on the WebNavigator client workstations; later IE versions are not officially supported on WinCC 6.2 SP2.

Troubleshooting Matrix

Field-Commissioning Notes

• Backup before changes: Always snapshot the WinCC project database and the GraCS folder before applying a hotfix or replacing PDL files. Use the WinCC Project Duplicator or the CCArchiveHandler tool.
• Test in a staging project first. The PDL replacement modifies faceplate behavior project-wide; verify on a copy of the production project before promoting.
• Document the hotfix level. Record the exact WinCC, WebNavigator, and PAS CC build numbers and HF levels in the project's Change Log. Future upgrades will need this history to reproduce the fix.
• Coordinate with operations. PDL replacement requires a runtime reload; schedule it for a maintenance window and notify control-room operators before the change.
• Validate redundant servers. If the project runs a redundant OS server pair, apply the hotfix and the modified PDL files to both servers before bringing the standby online.

For deeper coverage of SICAM SCC concepts and the WebNavigator configuration, see the official SICAM SCC Manual on Siemens Industry Online Support. The Web Navigator chapter describes the supported combinations of WinCC, PAS CC, and WebNavigator versions and lists the conditions under which the Basic Process Control plug-in is mandatory.