Riskcovery

CVE-2022-33137

State
Published
Severity
Not scored
Published
Jul 12, 2022
Updated
Aug 3, 2024
Reserved
Jun 13, 2022

Read the record on cve.org

Description

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-613 Insufficient Session Expiration

Affected Products

ProductVersions
SIMATIC MV540 HSiemens
  • All versions < V3.3Affected
SIMATIC MV540 SSiemens
  • All versions < V3.3Affected
SIMATIC MV550 HSiemens
  • All versions < V3.3Affected
SIMATIC MV550 SSiemens
  • All versions < V3.3Affected
SIMATIC MV560 USiemens
  • All versions < V3.3Affected
SIMATIC MV560 XSiemens
  • All versions < V3.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.