← Database

CVE-2022-24042

CRITICAL CVSS: 9.1 Published: 2022-05-10 Modified: 2026-06-17

Description

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. An attacker could be able to capture this token and re-use old session credentials or session IDs for authorization.

Affected Platforms

Siemens Desigo Pxc4 FirmwareSiemens Desigo Dxr2Siemens Desigo Pxc3 FirmwareSiemens Desigo Pxc4Siemens Desigo Dxr2 FirmwareSiemens Desigo Pxc3Siemens Desigo Pxc5 FirmwareSiemens Desigo Pxc5

Weakness Type

CWE-613, CWE-613

References