A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate users session even after logout.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Simatic_pcs_neo | Siemens | * | 4.1 (excluding) |
| Simatic_pcs_neo | Siemens | * | 5.0 (excluding) |
| Simatic_pcs_neo | Siemens | 4.1-update_1 (including) | 4.1-update_1 (including) |
| Simatic_pcs_neo | Siemens | 4.1-update_2 (including) | 4.1-update_2 (including) |
| Simatic_pcs_neo | Siemens | 5.0 (including) | 5.0 (including) |