CVE-2021-41545

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. When the controller receives a specific BACnet protocol packet, an exception cause...

Authorization

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application returns an AuthToken that does not expire at the defined auto...

Remote code execution

A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...

Default credentials

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...

Design/Logic Flaw

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. When the controller receives a specific BACnet protocol packet, an exception cause...

CVE-2022-24045

CVE-2022-24045 affects Siemens Desigo DXR2 and PXC series (DXR2 < v01.21.142.5-22; PXC3 < v01.21.142.4-18; PXC4 < v02.20.142.10-10884; PXC5

CVE-2022-24045

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The application, after a successful login, sets the session cookie on the browser...

CVE-2022-24044

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application does not employ any countermeasures...

CVE-2022-24044

The CVE-2022-24044 entry affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5 controllers. Root cause: the login functionality lacks protection against Password Spraying/Credential Stuffing, enabling an attacker to enumerate valid usernames and then perform targeted login attempts to gain access to a...

CVE-2022-24043

Siemens Desigo DXR2, PXC3, PXC4 and PXC5 are affected by CVE-2022-24043 due to a login-side-channel: the system does not normalize response times between failed logins with wrong usernames and correct usernames, enabling username enumeration. Affected versions are: Desigo DXR2 < v01.21.142.5-2...

CVE-2022-24042

CVE-2022-24042 affects Siemens Desigo DXR2, PXC3, PXC4, and PXC5 devices. The vulnerability is that the web application AuthToken does not expire after the defined auto logoff delay, enabling an attacker to capture a token and reuse old session credentials or session IDs for authorization. Affect...

CVE-2022-24042

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application returns an AuthToken that does not expire at the defined auto...

CVE-2022-24041

CVE-2022-24041 affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5 devices. The vulnerability stems from storing PBKDF2 password hashes with a low iteration count, enabling an attacker with user-profile access to retrieve other accounts’ password hashes and perform offline cracking to recover plaint...

CVE-2022-24041

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...

CVE-2022-24040

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application fails to enforce an upper bound to the cost factor of the PBKD...

CVE-2022-24040

CVE-2022-24040 affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5: the web app does not enforce an upper bound on PBKDF2 cost factor during account creation/update. An attacker with user-profile access can trigger a DoS by setting an excessively high PBKDF2 cost and attempting login, causing high C...

CVE-2022-24039

A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...

CVE-2022-24039

The CVE-2022-24039 vulnerability affects Siemens Desigo PXC4 (pre-2.20.142.10-10884) and Desigo PXC5 (pre-2.20.142.10-10884). The addCell JavaScript function does not properly sanitize user-controlled input when building the XML for XLS reports, allowing injection of arbitrary content (e.g., XML ...

CVE-2021-41545

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. When the controller receives a specific BACnet protocol packet, an exception cause...

CVE-2021-41545

CVE-2021-41545 affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5 controllers. When a device receives a specific BACnet packet, an exception can cause the BACnet communication function to enter an out-of-work state, potentially leading to a factory reset. Affected versions are: DXR2 all versions be...