Siemens SiPass integrated AC5102 / ACC-G2 and ACC-AP
view advisory published 2023-02-14
SiPass integrated ACC (Advanced Central Controller) devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges. Siemens has released updates for the affected products and recommends to update to the latest versions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31808US | high7.8 | — | ||
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - CSAF Versionself
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - PDF Versionself
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - TXT Versionself
- ICS Advisory ICSA-23-047-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-047-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (4)
- MitigationSiPass integrated AC5102 (ACC-G2)
Disable telnet access
- MitigationSiPass integrated ACC-AP
Disable telnet access
- FixedSiPass integrated AC5102 (ACC-G2)
Update to V2.85.44 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814044/ - FixedSiPass integrated ACC-AP
Update to V2.85.43 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814044/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan