CVE-2024-45386 Overview
CVE-2024-45386 affects multiple Siemens engineering and automation products, including SIMATIC PCS neo, SIMOCODE ES, SIRIUS Safety ES, SIRIUS Soft Starter ES, and TIA Administrator. The affected products do not correctly invalidate user sessions upon logout. A remote unauthenticated attacker who obtains a valid session token through other means can replay that token to access the application as the legitimate user, even after logout. The flaw maps to [CWE-613] Insufficient Session Expiration. Siemens published advisory SSA-342348 to coordinate fixes across the affected product lines.
Critical Impact
Session tokens remain valid after user logout, allowing attackers with a captured token to hijack authenticated sessions and gain full access to industrial control engineering interfaces.
Affected Products
- SIMATIC PCS neo V4.0 (all versions), V4.1 (versions prior to V4.1 Update 2), V5.0 (versions prior to V5.0 Update 1)
- SIMOCODE ES V19, SIRIUS Safety ES V19 (TIA Portal), SIRIUS Soft Starter ES V19 (TIA Portal) — all versions prior to V19 Update 1
- TIA Administrator versions prior to V3.0.4
Discovery Timeline
- 2025-02-11 - CVE-2024-45386 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45386
Vulnerability Analysis
The vulnerability resides in the session management layer of Siemens engineering and process control web interfaces. When a user invokes the logout function, the server-side session state is not destroyed. The session token associated with the authenticated session remains valid until its natural expiration. An attacker who has obtained that token through any mechanism, including network interception, log exposure, browser artifact theft, or cross-site scripting, can replay it to interact with the application as the original user. The affected products manage operator and engineer access to industrial control systems, so unauthorized session reuse can translate directly to manipulation of plant configurations, recipes, safety logic, or device parameters. CWE-613 categorizes this class of weakness as Insufficient Session Expiration.
Root Cause
The logout handler in the affected products fails to invalidate the server-side session record and does not revoke the issued session token. Logout is treated as a client-side state change rather than a server-side authorization revocation. The token continues to authenticate subsequent requests until its time-based expiry.
Attack Vector
Exploitation requires the attacker to obtain a valid session token through a separate channel. Once acquired, the attacker submits the token in cookies or authorization headers to the engineering or administration endpoints. The request requires user interaction in the original authentication flow but no privileges from the attacker. Because the attack is network reachable and reuses a privileged token, the attacker inherits the victim's roles within SIMATIC PCS neo, TIA Administrator, or the affected ES applications.
No verified public proof-of-concept code is available. Refer to the Siemens Security Advisory SSA-342348 for vendor technical detail.
Detection Methods for CVE-2024-45386
Indicators of Compromise
- Authenticated activity on SIMATIC PCS neo, TIA Administrator, or ES web sessions occurring after a user-initiated logout event in application audit logs.
- Reuse of the same session cookie or bearer token from multiple source IP addresses or user agents within a short interval.
- Engineering changes, project downloads, or configuration writes performed under a user account outside that user's normal working hours.
Detection Strategies
- Correlate logout events with subsequent request logs sharing the same session identifier to identify post-logout token reuse.
- Hunt for session cookies whose lifetime extends beyond the documented logout boundary in HTTP access logs and reverse-proxy telemetry.
- Alert on source IP changes for an active session token, which can indicate token theft and replay.
Monitoring Recommendations
- Forward web server, reverse proxy, and Siemens application audit logs to a central SIEM and enable retention sufficient for incident reconstruction.
- Monitor north-south traffic to OT engineering hosts and flag connections to PCS neo and TIA Administrator endpoints from non-engineering subnets.
- Track administrative and project modification events in PCS neo and TIA Administrator and review them against an authorized change list.
How to Mitigate CVE-2024-45386
Immediate Actions Required
- Update SIMATIC PCS neo V4.1 to V4.1 Update 2 or later and V5.0 to V5.0 Update 1 or later.
- Update SIMOCODE ES V19, SIRIUS Safety ES V19, and SIRIUS Soft Starter ES V19 to V19 Update 1 or later.
- Update TIA Administrator to V3.0.4 or later.
- Restrict network access to the management and engineering web interfaces of affected products to dedicated engineering workstations on segmented networks.
Patch Information
Siemens has released fixed versions across the affected product families. Consult the Siemens Security Advisory SSA-342348 for the complete fixed-version matrix and upgrade procedures. SIMATIC PCS neo V4.0 has no listed fix in the advisory and should be planned for upgrade to a supported release.
Workarounds
- Instruct users to close the entire browser session after logout to clear in-memory session tokens until products are patched.
- Reduce session timeout values where configurable to minimize the validity window of tokens that survive logout.
- Place affected systems behind a network segment that enforces multi-factor authentication and short-lived tokens through a reverse proxy.
- Apply Siemens defense-in-depth guidance for industrial security to limit exposure of engineering interfaces to operator and corporate networks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
