Description
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Siemens SIMATIC PCS neo V4.0
Default version status: unknown
0 to < *affected
Siemens SIMATIC PCS neo V4.1
Default version status: unknown
0 to < V4.1 Update 2affected
Siemens SIMATIC PCS neo V5.0
Default version status: unknown
0 to < V5.0 Update 1affected
Siemens SIMOCODE ES V19
Default version status: unknown
0 to < V19 Update 1affected
Siemens SIRIUS Safety ES V19 (TIA Portal)
Default version status: unknown
0 to < V19 Update 1affected
Siemens SIRIUS Soft Starter ES V19 (TIA Portal)
Default version status: unknown
0 to < V19 Update 1affected
Siemens TIA Administrator
Default version status: unknown
0 to < V3.0.4affected