SSA-339086 V1.0: Insufficient Session Expiration Vulnerability in SIMATIC PCS neo

Risk Summary

<p>Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user’s session even after logout.</p> <p>Siemens has released new versions for the affected products and recommends to update to the latest versions.</p>

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)