CVE-2022-24041
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application stores the PBKDF2 derived key of users passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plaintext passwords of other users.
Affected (4)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 02.20.142.10-10884 |
| Running on/with | Platform Versions |
|---|---|
Siemens Desigo Pxc5 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Before 02.20.142.10-10884 |
| Running on/with | Platform Versions |
|---|---|
Siemens Desigo Pxc4 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Before 01.21.142.4-18 |
| Running on/with | Platform Versions |
|---|---|
Siemens Desigo Pxc3 | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Before 01.21.142.5-22 |
| Running on/with | Platform Versions |
|---|---|
Siemens Desigo Dxr2 | All versions |
References (2)
Source: productcert@siemens.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.