SSA-471761: Multiple Vulnerabilities in SICAM T Before V3.0
SICAM T before V3.0 contain multiple vulnerabilities. These include critical issues such as improper parameter and input validation, various Cross-Site Scripting (XSS) vulnerabilities , and a Cross-Site Request Forgery (CSRF) vulnerability . Additional weaknesses comprise session fixation, authentication and authorization bypasses , missing HTTPS protection, and missing cookie protection flags. These issues could potentially lead to remote code execution, denial of service, unauthorized access to web-interface functionality, session hijacking, impersonation of legitimate users, or allow an attacker to perform arbitrary actions on the device on behalf of a user. Siemens has released a new version for SICAM T and recommends to update to the latest version.
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-31238US | medium4.8 | — | ||
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA10-0AA… | ||||
| CVE-2023-30901US | high8.8 | — | ||
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA10-0AA… | ||||
| CVE-2022-43439US | high8.8 | — | ||
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions < V2.50), POWER… | ||||
| CVE-2022-41665US | high8.8 | — | ||
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA… | ||||
| CVE-2022-40226US | high8.1 | — | ||
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA… | ||||
| CVE-2022-29883US | medium5.0OT erhöht | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allo… | ||||
| CVE-2022-29882US | medium4.3 | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of t… | ||||
| CVE-2022-29881US | medium5.0OT erhöht | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain i… | ||||
| CVE-2022-29880US | low3.5 | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This could allow an authentica… | ||||
| CVE-2022-29879US | medium4.0OT erhöht | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain i… | ||||
| CVE-2022-29878US | medium6.8OT erhöht | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response co… | ||||
| CVE-2022-29876US | medium4.3 | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directl… | ||||
| CVE-2022-29874US | medium5.0OT erhöht | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could all… | ||||
| CVE-2022-29873US | high7.5 | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an una… | ||||
| CVE-2022-29872US | medium6.5 | — | ||
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow an authenticated attac… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (30)
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- MitigationSICAM T
Do not access links from untrusted sources while logged in at SICAM T
- BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/ - BehobenSICAM T
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan