Password Authentication Flaw in Desigo DXR2 and PXC Series by Siemens

CVE-2022-24044

What is CVE-2022-24044?

A critical vulnerability in multiple Desigo products from Siemens allows attackers to exploit weak authentication mechanisms. The affected versions of Desigo DXR2 and PXC series lack adequate protections against Password Spraying and Credential Stuffing attacks. An attacker can potentially identify valid usernames and then gain unauthorized access to accounts by executing targeted login attempts. This poses a significant threat to the security of systems using these products, enabling potential breaches and unauthorized control.

References