A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)…
Priority LOW 30CWE-614Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-311.
Summary
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.
Why it matters now
EPSS 0.00599 48th percentileScored 2026-11-07
Fix Fixed Desigo DXR2 (Siemens): V01.21.142.5-22Desigo PXC3 (Siemens): V01.21.142.4-18+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Desigo DXR2 | before V01.21.142.5-22 | V01.21.142.5-22 | Patch available | CNA |
| Siemens | Desigo PXC3 | before V01.21.142.4-18 | V01.21.142.4-18 | Patch available | CNA |
| Siemens | Desigo PXC4 | before V02.20.142.10-10884 | V02.20.142.10-10884 | Patch available | CNA |
| Siemens | Desigo PXC5 | before V02.20.142.10-10884 | V02.20.142.10-10884 | Patch available | CNA |
- Desigo DXR2 VendorSiemens Affected before V01.21.142.5-22 Fixed in V01.21.142.5-22 Patch available CNA
- Desigo PXC3 VendorSiemens Affected before V01.21.142.4-18 Fixed in V01.21.142.4-18 Patch available CNA
- Desigo PXC4 VendorSiemens Affected before V02.20.142.10-10884 Fixed in V02.20.142.10-10884 Patch available CNA
- Desigo PXC5 VendorSiemens Affected before V02.20.142.10-10884 Fixed in V02.20.142.10-10884 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:desigo_dxr2_firmware:*:*:*:*:*:*:*:* | before 01.21.142.5-22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_dxr2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_pxc3_firmware:*:*:*:*:*:*:*:* | before 01.21.142.4-18 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_pxc4_firmware:*:*:*:*:*:*:*:* | before 02.20.142.10-10884 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:desigo_pxc5_firmware:*:*:*:*:*:*:*:* | before 02.20.142.10-10884 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:desigo_pxc5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:desigo_dxr2_firmware:*:*:*:*:*:*:*:* Versions before 01.21.142.5-22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_dxr2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_pxc3_firmware:*:*:*:*:*:*:*:* Versions before 01.21.142.4-18 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_pxc4_firmware:*:*:*:*:*:*:*:* Versions before 02.20.142.10-10884 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:desigo_pxc5_firmware:*:*:*:*:*:*:*:* Versions before 02.20.142.10-10884 Vulnerable ·Siemens
- cpe:2.3:h:siemens:desigo_pxc5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Desigo DXR2 (Siemens) Fixed in V01.21.142.5-22
- Fix · CNA Desigo PXC3 (Siemens) Fixed in V01.21.142.4-18
- Fix · CNA Desigo PXC4 (Siemens) Fixed in V02.20.142.10-10884
- Fix · CNA Desigo PXC5 (Siemens) Fixed in V02.20.142.10-10884
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24045
- 2026-10-03 Alias added: GHSA-gh3j-qg8j-hhvj
References
More Siemens Desigo Dxr2 Firmware vulnerabilities
- TI-2022-08002 Insufficient session expiration in Siemens Desigo DXR2 CVSS 3.1CRITICAL 9.1
- TI-2022-08004 Missing brute-force protection in Siemens Desigo DXR2 CVSS 3.1HIGH 7.5
- TI-2021-18284 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)… CVSS 3.1HIGH 7.5
- TI-2022-08000 Uncontrolled resource consumption in Siemens Desigo DXR2 CVSS 3.1MEDIUM 6.5
- TI-2022-08001 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22)… CVSS 3.1MEDIUM 6.5
- TI-2022-08003 Observable discrepancy in Siemens Desigo DXR2 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-24045 · CVE Program
- CVE-2022-24045 · NVD
- FIRST EPSS
- GHSA-gh3j-qg8j-hhvj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences