Description
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nozomi Networks | Guardian | < 22.6.2 | 22.6.2 |
| Nozomi Networks | CMC | < 22.6.2 | 22.6.2 |
Advisories 2
- ICSA-23-285-07 Siemens RUGGEDCOM APE180 CISA ICS & IT advisories · May 14, 2024
- SSA-647455 SSA-647455: Multiple Vulnerabilities in Nozomi Guardian/CMC before 22.6.2 on RUGGEDCOM APE1808 devices Siemens ProductCERT · May 14, 2024