CVE-2024-45386: siemens simatic pcs neo v4.0 Insufficient Session Expiration

Vulnerability summary

CVE-2024-45386 is a high (CVSS 8.8) Insufficient Session Expiration vulnerability in siemens simatic pcs neo v4.0. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities.

Timeline

1. 11-02-2025
   PublishedVulnerability first disclosed.
2. 11-02-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."