Multiple Siemens Products Access Control Error Vulnerabilities

Siemens SICAM is an integrated substation automation system from Siemens (Germany). An access control error vulnerability exists in several Siemens products. The vulnerability stems from the fact that the affected device accepts a user-defined session cookie and does not update the session cookie after login/logout, which could be exploited to take over another user’s session after login.