Siemens Gridscale X Prepay Authentication Token Capture-Replay Vulnerability

A vulnerability exists in Siemens Gridscale X Prepay, all versions prior to 4.2.1, allowing for the capture and replay of authentication tokens. This issue enables an authenticated user who has been locked out to re-establish a valid user session.

Impact

Exploitation of this vulnerability could allow a locked-out user to regain access to their account by re-establishing a valid session, bypassing the lockout restriction.

Remediation

Siemens has released a new version of Gridscale X Prepay. Users are advised to update to the latest version. For further information, please contact your local Siemens representative.