Username enumeration via unnormalized login response timing

Username enumeration in affected Siemens SIMATIC web servers allows remote attackers to identify valid usernames through login timing. The login handler does not normalize response times for valid and invalid usernames, creating an observable timing discrepancy. The web server must be reachable over HTTP; the documented consequence is disclosure of valid account names, not password recovery or authenticated access.