Username Enumeration Vulnerability in Siemens Desigo Products

CVE-2022-24043

Summary

A vulnerability has been identified in Siemens' Desigo product line, affecting multiple versions of the DXR2, PXC3, PXC4, and PXC5 models. The issue arises from improper normalization of response times during login attempts, allowing a remote unauthenticated attacker to distinguish between successful and failed login attempts based on their timing. This could facilitate a username enumeration attack, enabling attackers to ascertain valid usernames and potentially facilitating further attacks on the system.

References