CVE-2022-33137: Siemens SIMATIC MV540 H Firmware

High severity, CVSS 8.0. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.

Affected products

• Siemens SIMATIC MV540 H Firmware: before 3.3 (fixed in 3.3)
• Siemens SIMATIC MV540 S Firmware: before 3.3 (fixed in 3.3)
• Siemens SIMATIC MV550 H Firmware: before 3.3 (fixed in 3.3)
• Siemens SIMATIC MV550 S Firmware: before 3.3 (fixed in 3.3)
• Siemens SIMATIC MV560 U Firmware: before 3.3 (fixed in 3.3)
• Siemens SIMATIC MV560 X Firmware: before 3.3 (fixed in 3.3)

Published 2022-07-12. Last modified 2026-06-17.