MEDIUM🇵🇱 Wersja polska

CVE-2022-24043

CVSS 5.3v3.1pub. 2022-05-20upd. 2024-11-21

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application fails to normalize the response times of login attempts performed with wrong usernames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel information to perform a username enumeration attack and identify valid usernames.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Siemens Desigo Dxr2

    HW
    Siemens
    all versions

  • Siemens Desigo Dxr2 Firmware

    OS
    Siemens
    < 01.21.142.5-22

  • Siemens Desigo Pxc3

    HW
    Siemens
    all versions

  • Siemens Desigo Pxc3 Firmware

    OS
    Siemens
    < 01.21.142.4-18

  • Siemens Desigo Pxc4

    HW
    Siemens
    all versions

  • Siemens Desigo Pxc4 Firmware

    OS
    Siemens
    < 02.20.142.10-10884

  • Siemens Desigo Pxc5

    HW
    Siemens
    all versions

  • Siemens Desigo Pxc5 Firmware

    OS
    Siemens
    < 02.20.142.10-10884
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-24039CRITICAL9.0PL ✓same product

RCE przez brak sanityzacji danych wejściowych w Siemens Desigo PXC4/PXC5

CVE-2022-24042CRITICAL9.1PL ✓same product

Siemens Desigo PXC/DXR2 — brak wygasania tokenu sesji (CWE-613)

CVE-2022-24044HIGH7.5same product

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions...

CVE-2021-41545HIGH7.5same product

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions...

CVE-2022-24045MEDIUM6.5same product

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions...