Lucene search
SiemensCVELIST:CVE-2022-24043HistoryMay 10, 2022 - 9:46 a.m.
CVE-2022-24043
2022-05-1009:46:53
CWE-203
siemens
www.cve.org
3
cve-2022-24043
side-channel information
username enumeration
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application fails to normalize the response times of login attempts performed with wrong usernames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel information to perform a username enumeration attack and identify valid usernames.
CNA Affected
[
{
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V01.21.142.5-22"
}
]
},
{
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V01.21.142.4-18"
}
]
},
{
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V02.20.142.10-10884"
}
]
},
{
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V02.20.142.10-10884"
}
]
}
]Related
nvd
nvd
CVE-2022-24043
2022-05-20 13:15:14
prion
prion
Design/Logic Flaw
2022-05-20 13:15:00
nessus
nessus
Siemens Desigo PXC and DXR Devices Observable Discrepancy (CVE-2022-24043)
2023-01-25 00:00:00
cve
cve
CVE-2022-24043
2022-05-20 13:15:14
ics
ics
Siemens Desigo PXC and DXR Devices (Update A)
2022-06-16 12:00:00