Session Cookie Vulnerability in POWER METER SICAM Q200 by Siemens

CVE-2022-43398

Summary

A vulnerability has been identified in the POWER METER SICAM Q200 family, where the devices fail to renew session cookies after user login/logout events and allow the acceptance of user-defined session cookies. This flaw enables an attacker to overwrite a legitimate user's session cookie, granting unauthorized access to the victim's account once they have logged in. The security implication of this vulnerability reflects a significant risk, as it could permit attackers to manipulate user sessions and potentially compromise sensitive information.

References