← Database

CVE-2022-33137

HIGH CVSS: 8.0 Published: 2022-07-12 Modified: 2026-06-17

Description

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.

Affected Platforms

Siemens Simatic Mv560 XSiemens Simatic Mv540 S FirmwareSiemens Simatic Mv550 SSiemens Simatic Mv560 USiemens Simatic Mv540 SSiemens Simatic Mv560 X FirmwareSiemens Simatic Mv560 U FirmwareSiemens Simatic Mv550 S FirmwareSiemens Simatic Mv550 H FirmwareSiemens Simatic Mv550 H

Weakness Type

CWE-613, CWE-613

References