CVEvulnerability
CVE-2022-24042
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-05-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-613
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. An attacker could be able to capture this token and re-use old session credentials or session IDs for authorization.
Affected configurations
• siemens desigo pxc5 firmware (< 02.20.142.10-10884)
• siemens desigo pxc4 firmware (< 02.20.142.10-10884)
• siemens desigo pxc3 firmware (< 01.21.142.4-18)
• siemens desigo dxr2 firmware (< 01.21.142.5-22)
Related
Weakness · not in database (1)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf Vendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf Vendor Advisory