CVE-2024-45386: High severity siemens simatic pcs neo firmware vulnerability
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45386?
The severity of CVE-2024-45386 has not been explicitly stated, but vulnerabilities in industrial control systems typically warrant urgent attention due to potential impacts on safety and security.
How do I fix CVE-2024-45386?
To fix CVE-2024-45386, update the affected software to the latest versions as specified in the vendor's security advisory.
What versions of SIMATIC PCS neo are affected by CVE-2024-45386?
CVE-2024-45386 affects all versions of SIMATIC PCS neo V4.0, all versions of V4.1 below V4.1 Update 2, and all versions of V5.0 below V5.0 Update 1.
Which Siemens products are impacted by CVE-2024-45386?
CVE-2024-45386 impacts Siemens SIMATIC PCS neo, SIMOCODE ES, SIRIUS Safety ES, SIRIUS Soft Starter ES, and TIA Administrator.
Is there a workaround for CVE-2024-45386?
Currently, no known workaround exists for CVE-2024-45386, so applying the updates is the recommended action.