CVE-2022-24041
Medium
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application stores the PBKDF2 derived key of users passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plaintext passwords of other users.
SeverityMedium
CVSS6.5
Exploit probability—
ProductSiemens Desigo Pxc5 Firmware
PublishedMay 10, 2022
First seenMay 10, 2022
Weakness typeCWE-916CWE-916
How to fix
Update
- siemens desigo_pxc5_firmware02.20.142.10-10884 or later
- siemens desigo_pxc4_firmware02.20.142.10-10884 or later
- siemens desigo_pxc3_firmware01.21.142.4-18 or later
- siemens desigo_dxr2_firmware01.21.142.5-22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens desigo_pxc5_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc4_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc3_firmware | v < 01.21.142.4-18 | 01.21.142.4-18 |
| siemens desigo_dxr2_firmware | v < 01.21.142.5-22 | 01.21.142.5-22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.