Summary
Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 8.8
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All v…
Revision history
-
#1
Publication Date
References
-
SSA-339086: Insufficient Session Expiration Vulnerability in SIMATIC PCS neo - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-339086.html