High severity8.0NVD Advisory· Published Jul 12, 2022· Updated Jun 17, 2026
CVE-2022-33137
CVE-2022-33137
Description
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.
Affected products
15- cpe:2.3:o:siemens:simatic_mv540_h_firmware:*:*:*:*:*:*:*:*Range: <3.3
- cpe:2.3:o:siemens:simatic_mv540_s_firmware:*:*:*:*:*:*:*:*Range: <3.3
- cpe:2.3:o:siemens:simatic_mv550_h_firmware:*:*:*:*:*:*:*:*Range: <3.3
- cpe:2.3:o:siemens:simatic_mv550_s_firmware:*:*:*:*:*:*:*:*Range: <3.3
- cpe:2.3:o:siemens:simatic_mv560_u_firmware:*:*:*:*:*:*:*:*Range: <3.3
- cpe:2.3:o:siemens:simatic_mv560_x_firmware:*:*:*:*:*:*:*:*Range: <3.3
< V3.3+ 2 more
- (no CPE)range: < V3.3
- (no CPE)range: All versions < V3.3
- (no CPE)range: All versions < V3.3
< V3.3+ 2 more
- (no CPE)range: < V3.3
- (no CPE)range: All versions < V3.3
- (no CPE)range: All versions < V3.3
< V3.3+ 2 more
- (no CPE)range: < V3.3
- (no CPE)range: All versions < V3.3
- (no CPE)range: All versions < V3.3
Patches
Vulnerability mechanics
References
1- cert-portal.siemens.com/productcert/pdf/ssa-348662.pdfnvdPatchVendor Advisory
News mentions
0No linked articles in our index yet.