← Database

CVE-2022-24043

MEDIUM CVSS: 5.3 Published: 2022-05-20 Modified: 2026-06-17

Description

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application fails to normalize the response times of login attempts performed with wrong usernames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel information to perform a username enumeration attack and identify valid usernames.

Affected Platforms

Siemens Desigo Pxc4 FirmwareSiemens Desigo Dxr2Siemens Desigo Pxc3 FirmwareSiemens Desigo Pxc4Siemens Desigo Dxr2 FirmwareSiemens Desigo Pxc3Siemens Desigo Pxc5 FirmwareSiemens Desigo Pxc5

Weakness Type

CWE-203, CWE-203

References