CVE:CVE-2022-24042
CNNVD:CNNVD-202205-2785
Siemens Desigo DXR2等都是德国西门子（Siemens）公司的一个楼宇自动化和控制产品。
Siemens Desigo DXR2 V01.21.142.5-22之前版本和Desigo PXC3 V01.21.142.4-18之前版本和Desigo PXC4 V02.20.142.10-10884之前版本和Desigo PXC5 V02.20.142.10-10884之前版本存在安全漏洞，该漏洞源于 Web 应用程序返回一个不会超时后过期的 AuthToken。攻击者可能能够捕获此令牌并重新使用旧会话凭据或会话 ID 进行授权。
solution:Upgrade siemens desigo_pxc5_firmware to a higher version than 02.20.142.10-10884,and avoid the version (,02.20.142.10-10884); Upgrade siemens desigo_pxc4_firmware to a higher version than 02.20.142.10-10884,and avoid the version (,02.20.142.10-10884); Upgrade siemens desigo_pxc3_firmware to a higher version than 01.21.142.4-18,and avoid the version (,01.21.142.4-18); Upgrade siemens desigo_dxr2_firmware to a higher version than 01.21.142.5-22,and avoid the version (,01.21.142.5-22)