SB2022051124 - Multiple vulnerabilities in Siemens Desigo PXC and DXR Devices
Published: May 11, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2022-24040)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Use of Password Hash With Insufficient Computational Effort (CVE-ID: CVE-2022-24041)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the web application stores the PBKDF2 derived key of users passwords with a low iteration count. A remote user can gain unauthorized access to sensitive information on the system.
3) Insufficient Session Expiration (CVE-ID: CVE-2022-24042)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.
4) Observable discrepancy (CVE-ID: CVE-2022-24043)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to observable discrepancy issue in the login functionality. A remote attacker can gain unauthorized access to sensitive information on the system.
5) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2022-24044)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the login functionality of the application does not employ any countermeasures against Password Spraying attacks or Credential Stuffing attacks. A remote attacker can gain unauthorized access to sensitive information on the system.
6) Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-ID: CVE-2022-24045)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes. A remote user can gain unauthorized access to sensitive information on the system.
7) Input validation error (CVE-ID: CVE-2022-24039)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to the "addCell" JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
8) Uncaught Exception (CVE-ID: CVE-2021-41545)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncaught exception within the BACnet communication function. A remote attacker can cause a denial of service condition on the target system.
Remediation
Install update from vendor's website.