{"cve":"CVE-2022-24040","nvd":{"published":"2022-05-10T11:15:08.287","modified":"2026-06-17T04:31:12.017","status":"Modified","description":"A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-400"],"references":["https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf"],"products":["siemens:desigo_dxr2_firmware","siemens:desigo_pxc3_firmware","siemens:desigo_pxc4_firmware","siemens:desigo_pxc5_firmware"],"source":"nvd","synced_at":"2026-10-19T21:31:59.322382750+00:00"},"epss":{"cve":"CVE-2022-24040","score":0.00855,"percentile":0.58379,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}