CVE-2022-24044
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application does not employ any countermeasures against Password Spraying attacks or Credential Stuffing attacks. An attacker could obtain a list of valid usernames on the device by exploiting the issue and then perform a precise Password Spraying or Credential Stuffing attack in order to obtain access to at least one account.
How to fix
- siemens desigo_dxr2_firmware01.21.142.5-22 or later
- siemens desigo_pxc3_firmware01.21.142.4-18 or later
- siemens desigo_pxc4_firmware02.20.142.10-10884 or later
- siemens desigo_pxc5_firmware02.20.142.10-10884 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens desigo_dxr2_firmware | v < 01.21.142.5-22 | 01.21.142.5-22 |
| siemens desigo_pxc3_firmware | v < 01.21.142.4-18 | 01.21.142.4-18 |
| siemens desigo_pxc4_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc5_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.