Description
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC PCS neo V4.1 | < V4.1 Update 3 | V4.1 Update 3 |
| Siemens | SIMATIC PCS neo V5.0 | < V5.0 Update 1 | V5.0 Update 1 |
Advisories 3
- NCSC-2025-0160 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · May 14, 2025
- ICSA-25-135-12 Siemens SIMATIC PCS CISA ICS & IT advisories · May 13, 2025
- SSA-339086 SSA-339086: Insufficient Session Expiration Vulnerability in SIMATIC PCS neo Siemens ProductCERT · May 13, 2025