Description (CNA)
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Siemens / SIMATIC PCS neo V4.0 | affected 0 before * |
| Siemens / SIMATIC PCS neo V4.1 | affected 0 before V4.1 Update 2 |
| Siemens / SIMATIC PCS neo V5.0 | affected 0 before V5.0 Update 1 |
| Siemens / SIMOCODE ES V19 | affected 0 before V19 Update 1 |
| Siemens / SIRIUS Safety ES V19 (TIA Portal) | affected 0 before V19 Update 1 |
| Siemens / SIRIUS Soft Starter ES V19 (TIA Portal) | affected 0 before V19 Update 1 |
| Siemens / TIA Administrator | affected 0 before V3.0.4 |
CWE
CWE-613
References
ADP enrichment
No English description supplied.
No references supplied.