CVE-2024-45386

State: Published
Severity: 8.7 High
Published: Feb 11, 2025
Updated: Feb 11, 2025
Reserved: Aug 28, 2024

Description

A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	siemens
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	siemens

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
SIMATIC PCS neo V4.0Siemens	all versionsAffected
SIMATIC PCS neo V4.1Siemens	before V4.1 Update 2Affected
SIMATIC PCS neo V5.0Siemens	before V5.0 Update 1Affected
SIMOCODE ES V19Siemens	before V19 Update 1Affected
SIRIUS Safety ES V19 (TIA Portal)Siemens	before V19 Update 1Affected
SIRIUS Soft Starter ES V19 (TIA Portal)Siemens	before V19 Update 1Affected
TIA AdministratorSiemens	before V3.0.4Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-342348.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.