CVE-2022-24045
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.
How to fix
- siemens desigo_dxr2_firmware01.21.142.5-22 or later
- siemens desigo_pxc3_firmware01.21.142.4-18 or later
- siemens desigo_pxc4_firmware02.20.142.10-10884 or later
- siemens desigo_pxc5_firmware02.20.142.10-10884 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens desigo_dxr2_firmware | v < 01.21.142.5-22 | 01.21.142.5-22 |
| siemens desigo_pxc3_firmware | v < 01.21.142.4-18 | 01.21.142.4-18 |
| siemens desigo_pxc4_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc5_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.