Lucene search

SiemensCVE-2022-24045

HistoryMay 20, 2022 - 1:15 p.m.

CVE-2022-24045

2022-05-2013:15:14

CWE-311

CWE-614

siemens

web.nvd.nist.gov

cve-2022-24045

desigo dxr2

desigo pxc3

desigo pxc4

desigo pxc5

vulnerability

session cookie

security issue

network sniffing

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

23.8%

JSON

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.

Affected configurations

Nvd

Node

siemensdesigo_dxr2_firmwareRange<01.21.142.5-22

AND

siemensdesigo_dxr2Match-

Node

siemensdesigo_pxc3_firmwareRange<01.21.142.4-18

AND

siemensdesigo_pxc3Match-

Node

siemensdesigo_pxc4_firmwareRange<02.20.142.10-10884

AND

siemensdesigo_pxc4Match-

Node

siemensdesigo_pxc5_firmwareRange<02.20.142.10-10884

AND

siemensdesigo_pxc5Match-

VendorProductVersionCPE
siemensdesigo_dxr2_firmware*cpe:2.3:o:siemens:desigo_dxr2_firmware:*:*:*:*:*:*:*:*
siemensdesigo_dxr2-cpe:2.3:h:siemens:desigo_dxr2:-:*:*:*:*:*:*:*
siemensdesigo_pxc3_firmware*cpe:2.3:o:siemens:desigo_pxc3_firmware:*:*:*:*:*:*:*:*
siemensdesigo_pxc3-cpe:2.3:h:siemens:desigo_pxc3:-:*:*:*:*:*:*:*
siemensdesigo_pxc4_firmware*cpe:2.3:o:siemens:desigo_pxc4_firmware:*:*:*:*:*:*:*:*
siemensdesigo_pxc4-cpe:2.3:h:siemens:desigo_pxc4:-:*:*:*:*:*:*:*
siemensdesigo_pxc5_firmware*cpe:2.3:o:siemens:desigo_pxc5_firmware:*:*:*:*:*:*:*:*
siemensdesigo_pxc5-cpe:2.3:h:siemens:desigo_pxc5:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	desigo_dxr2_firmware	*	cpe:2.3:o:siemens:desigo_dxr2_firmware::::::::
siemens	desigo_dxr2	-	cpe:2.3:h:siemens:desigo_dxr2:-:::::::*
siemens	desigo_pxc3_firmware	*	cpe:2.3:o:siemens:desigo_pxc3_firmware::::::::
siemens	desigo_pxc3	-	cpe:2.3:h:siemens:desigo_pxc3:-:::::::*
siemens	desigo_pxc4_firmware	*	cpe:2.3:o:siemens:desigo_pxc4_firmware::::::::
siemens	desigo_pxc4	-	cpe:2.3:h:siemens:desigo_pxc4:-:::::::*
siemens	desigo_pxc5_firmware	*	cpe:2.3:o:siemens:desigo_pxc5_firmware::::::::
siemens	desigo_pxc5	-	cpe:2.3:h:siemens:desigo_pxc5:-:::::::*

CNA Affected

[
  {
    "product": "Desigo DXR2",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V01.21.142.5-22"
      }
    ]
  },
  {
    "product": "Desigo PXC3",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V01.21.142.4-18"
      }
    ]
  },
  {
    "product": "Desigo PXC4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V02.20.142.10-10884"
      }
    ]
  },
  {
    "product": "Desigo PXC5",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V02.20.142.10-10884"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

23.8%

JSON

Related for CVE-2022-24045