description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.
problem types: CWE-613: Insufficient Session Expiration
affected:
{
product: SIMATIC MV540 H
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
{
product: SIMATIC MV540 S
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
{
product: SIMATIC MV550 H
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
{
product: SIMATIC MV550 S
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
{
product: SIMATIC MV560 U
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
{
product: SIMATIC MV560 X
vendor: Siemens
versions:
status: affected, version: All versions < V3.3
}
