Insufficient Session Expiration Vulnerability in SIMATIC PCS neo
Plan Patch8.8SSA-339086May 13, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
SIMATIC PCS neo does not correctly invalidate user sessions upon logout. A remote attacker who obtains a session token by other means can reuse a legitimate user's session even after the user logs out. This affects SIMATIC PCS neo V4.1 (all versions before Update 3) and V5.0 (all versions before Update 1).
What this means
What could happen
An attacker with a stolen session token can maintain unauthorized access to SIMATIC PCS neo after the legitimate user logs out, potentially allowing them to modify process configurations, view sensitive operating parameters, or disrupt engineering workstation functionality without being detected.
Who's at risk
Organizations using SIMATIC PCS neo for process automation engineering and control system management should prioritize this update. This affects engineering workstations and systems that rely on SIMATIC PCS neo for configuration and monitoring of industrial processes in manufacturing, utilities, and critical infrastructure sectors.
How it could be exploited
An attacker obtains a session token through network interception, social engineering, or another compromise method. The attacker then uses this token to access SIMATIC PCS neo after the legitimate user has logged out. Because sessions are not properly invalidated on logout, the stolen token remains valid and grants full access to the application.
Prerequisites
- Session token obtained through interception or secondary compromise
- Network access to SIMATIC PCS neo application
- Knowledge of valid session token format
Remotely exploitableRequires prior session token compromiseAffects engineering workstation access controlHigh CVSS score (8.8)
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
SIMATIC PCS neo V4.1All versions < V4.1 Update 34.1 Update 3
SIMATIC PCS neo V5.0All versions < V5.0 Update 15.0 Update 1
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
SIMATIC PCS neo V4.1
HOTFIXUpdate SIMATIC PCS neo V4.1 to Update 3 or later
SIMATIC PCS neo V5.0
HOTFIXUpdate SIMATIC PCS neo V5.0 to Update 1 or later
Long-term hardening
0/2HARDENINGImplement network segmentation to restrict access to SIMATIC PCS neo engineering workstations from untrusted networks
HARDENINGMonitor engineering workstations for suspicious session activity or failed authentication attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/615cf924-54f4-4ca5-8f37-3c70ad3349ad