CVE-2022-24042
Critical
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. An attacker could be able to capture this token and re-use old session credentials or session IDs for authorization.
SeverityCritical
CVSS9.1
Exploit probability—
ProductSiemens Desigo Pxc5 Firmware
PublishedMay 10, 2022
First seenMay 10, 2022
Weakness typeCWE-613CWE-613
How to fix
Update
- siemens desigo_pxc5_firmware02.20.142.10-10884 or later
- siemens desigo_pxc4_firmware02.20.142.10-10884 or later
- siemens desigo_pxc3_firmware01.21.142.4-18 or later
- siemens desigo_dxr2_firmware01.21.142.5-22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens desigo_pxc5_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc4_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc3_firmware | v < 01.21.142.4-18 | 01.21.142.4-18 |
| siemens desigo_dxr2_firmware | v < 01.21.142.5-22 | 01.21.142.5-22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.