{"id":"CVE-2024-45386","aliases":["EUVD-2025-4986","GHSA-4688-8pmg-jw5w"],"status":"published","title":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 ...","description":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \u003c V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions \u003c V5.0 Update 1), SIMOCODE ES V19 (All versions \u003c V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions \u003c V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions \u003c V19 Update 1), TIA Administrator (All versions \u003c V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00556,"percentile":0.46704,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2025-02-11T10:28:44Z","modified":"2026-06-17T07:54:06Z","products":[{"vendor":"siemens","product":"simatic pcs neo v4.0"},{"vendor":"siemens","product":"simatic pcs neo v4.1"},{"vendor":"siemens","product":"simatic pcs neo v5.0"},{"vendor":"siemens","product":"simocode es v19"},{"vendor":"siemens","product":"sirius safety es v19 (tia portal)"},{"vendor":"siemens","product":"sirius soft starter es v19 (tia portal)"},{"vendor":"siemens","product":"tia administrator"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-342348.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45386"},{"url":"https://github.com/advisories/GHSA-4688-8pmg-jw5w"}],"sources":{"cve":[{"id":"CVE-2024-45386","description":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \u003c V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions \u003c V5.0 Update 1), SIMOCODE ES V19 (All versions \u003c V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions \u003c V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions \u003c V19 Update 1), TIA Administrator (All versions \u003c V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.","status":"published","published":"2025-02-11T10:28:44.675Z","modified":"2025-02-11T14:38:30.854Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2025-4986","description":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \u003c V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions \u003c V5.0 Update 1), SIMOCODE ES V19 (All versions \u003c V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions \u003c V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions \u003c V19 Update 1), TIA Administrator (All versions \u003c V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.","status":"published","published":"2025-02-11T10:28:44Z","modified":"2025-02-11T14:38:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:03:59.807436Z"}],"ghsa":[{"id":"GHSA-4688-8pmg-jw5w","title":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 ...","description":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \u003c V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions \u003c V5.0 Update 1), SIMOCODE ES V19 (All versions \u003c V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions \u003c V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions \u003c V19 Update 1), TIA Administrator (All versions \u003c V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.","status":"published","published":"2025-02-11T12:30:54Z","modified":"2025-02-11T12:31:02Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:59:52.638126Z"}],"nvd":[{"id":"CVE-2024-45386","description":"A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions \u003c V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions \u003c V5.0 Update 1), SIMOCODE ES V19 (All versions \u003c V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions \u003c V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions \u003c V19 Update 1), TIA Administrator (All versions \u003c V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.","status":"published","published":"2025-02-11T11:15:13.627Z","modified":"2026-06-17T07:54:06.847Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:10:44.033107Z"}]}}