CVE-2022-33137

CVE-2022-33137

Vendor Siemens
Product SIMATIC MV540 H
Weakness CWE-613 · Insufficient session expiration
Published July 12, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.

Key dates

02Disclosure timeline

July 12, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-22732 Insufficient Session Expiration in Administration in shopware CVE-2021-1501 Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service Vulnerability CVE-2025-55264 HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change CVE-2021-21031 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access CVE-2026-27652 CloudCharge cloudcharge.se Insufficient Session Expiration