CVE-2024-45386 Auth bypass in SIMATIC PCS neo V4.0
Attackers can reuse session tokens after logout to hijack legitimate user sessions in Siemens industrial automation products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-45386?
CVE-2024-45386 is a high-severity authentication bypass vulnerability in Siemens SIMATIC PCS neo V4.0, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Weakness: CWE-613
Which versions are affected by CVE-2024-45386?
How do I fix CVE-2024-45386?
No fix has been published for CVE-2024-45386 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-45386 being exploited?
There is no known exploitation of CVE-2024-45386 in the wild and no public exploit code.
Sources
Also known as GHSA-4688-8pmg-jw5w.