Lucene search
SiemensCVELIST:CVE-2022-24042HistoryMay 10, 2022 - 9:46 a.m.
CVE-2022-24042
2022-05-1009:46:51
CWE-613
siemens
www.cve.org
2
desigo dxr2
pxc3
pxc4
pxc5
web application
authtoken
expiration
timeout
attacker
capture
session credentials
authorization
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. An attacker could be able to capture this token and re-use old session credentials or session IDs for authorization.
CNA Affected
[
{
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V01.21.142.5-22"
}
]
},
{
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V01.21.142.4-18"
}
]
},
{
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V02.20.142.10-10884"
}
]
},
{
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V02.20.142.10-10884"
}
]
}
]Related
nessus
nessus
prion
prion
Authorization
2022-05-10 11:15:00
nvd
nvd
CVE-2022-24042
2022-05-10 11:15:08
cve
cve
CVE-2022-24042
2022-05-10 11:15:08
ics
ics
Siemens Desigo PXC and DXR Devices (Update A)
2022-06-16 12:00:00