Uncontrolled resource consumption in Siemens Desigo DXR2
Priority LOW 30CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.
Why it matters now
EPSS 0.00855 58th percentileScored 2026-11-07
Fix Fixed Desigo DXR2 (Siemens): V01.21.142.5-22Desigo PXC3 (Siemens): V01.21.142.4-18+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Desigo DXR2 | before V01.21.142.5-22 | V01.21.142.5-22 | Patch available | CNA |
| Siemens | Desigo PXC3 | before V01.21.142.4-18 | V01.21.142.4-18 | Patch available | CNA |
| Siemens | Desigo PXC4 | before V02.20.142.10-10884 | V02.20.142.10-10884 | Patch available | CNA |
| Siemens | Desigo PXC5 | before V02.20.142.10-10884 | V02.20.142.10-10884 | Patch available | CNA |
- Desigo DXR2 VendorSiemens Affected before V01.21.142.5-22 Fixed in V01.21.142.5-22 Patch available CNA
- Desigo PXC3 VendorSiemens Affected before V01.21.142.4-18 Fixed in V01.21.142.4-18 Patch available CNA
- Desigo PXC4 VendorSiemens Affected before V02.20.142.10-10884 Fixed in V02.20.142.10-10884 Patch available CNA
- Desigo PXC5 VendorSiemens Affected before V02.20.142.10-10884 Fixed in V02.20.142.10-10884 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:desigo_pxc5_firmware:*:*:*:*:*:*:*:* | before 02.20.142.10-10884 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_pxc4_firmware:*:*:*:*:*:*:*:* | before 02.20.142.10-10884 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_pxc3_firmware:*:*:*:*:*:*:*:* | before 01.21.142.4-18 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_dxr2_firmware:*:*:*:*:*:*:*:* | before 01.21.142.5-22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_dxr2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:desigo_pxc5_firmware:*:*:*:*:*:*:*:* Versions before 02.20.142.10-10884 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_pxc4_firmware:*:*:*:*:*:*:*:* Versions before 02.20.142.10-10884 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_pxc3_firmware:*:*:*:*:*:*:*:* Versions before 01.21.142.4-18 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_dxr2_firmware:*:*:*:*:*:*:*:* Versions before 01.21.142.5-22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_dxr2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Desigo DXR2 (Siemens) Fixed in V01.21.142.5-22
- Fix · CNA Desigo PXC3 (Siemens) Fixed in V01.21.142.4-18
- Fix · CNA Desigo PXC4 (Siemens) Fixed in V02.20.142.10-10884
- Fix · CNA Desigo PXC5 (Siemens) Fixed in V02.20.142.10-10884
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24040
- 2026-10-03 Alias added: GHSA-gvmv-rhmr-mw99
References
More Siemens Desigo Dxr2 Firmware vulnerabilities
- TI-2022-08002 Insufficient session expiration in Siemens Desigo DXR2 CVSS 3.1CRITICAL 9.1
- TI-2022-08004 Missing brute-force protection in Siemens Desigo DXR2 CVSS 3.1HIGH 7.5
- TI-2021-18284 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)… CVSS 3.1HIGH 7.5
- TI-2022-08005 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)… CVSS 3.1MEDIUM 6.5
- TI-2022-08001 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)… CVSS 3.1MEDIUM 6.5
- TI-2022-08003 Observable discrepancy in Siemens Desigo DXR2 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-24040 · CVE Program
- CVE-2022-24040 · NVD
- FIRST EPSS
- GHSA-gvmv-rhmr-mw99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences