Skip to content
OpenAdvisories
High SSA-342348 1 CVE

SSA-342348: Insufficient Session Expiration Vulnerability in Siemens Products

Published Feb 11, 2025 · Updated Feb 11, 2025

Vendor: Siemens Product: SIMATIC PCS neo V4.0 Product: SIMATIC PCS neo V4.1 Product: SIMATIC PCS neo V5.0 Product: SIMOCODE ES V19 Product: SIRIUS Safety ES V19 (TIA Portal) Product: SIRIUS Soft Starter ES V19 (TIA Portal) Product: TIA Administrator

Summary

Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #1

    Publication Date

References