Session hijacking via logout token persistence

Insufficient session expiration in Siemens industrial software allows remote attackers with a captured token to reuse a logged-out session. The logout path fails to invalidate the server-side session, so the captured token continues to inherit the legitimate user's authorization. Exploitation requires prior acquisition of that token and can expose every action and resource authorized to the session.