CVE-2022-29873

highPriorität · verfolgen · 31EPSS 0.020 · 81. PerzentilDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.99% (81st) EPSS

CVSS 7.5 · high

Is it mine?

82 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSICAM P850siemens_psirt
Update to V3.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743594/
BehobenSICAM P855siemens_psirt
Update to V3.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743621/
BehobenSICAM Tsiemens_psirt
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743625/
BehobenSICAM P850cisa_csaf_ot
Update to V3.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743594/
BehobenSICAM P855cisa_csaf_ot
Update to V3.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743621/
MitigationSICAM P850siemens_psirt
Do not access links from untrusted sources while logged in at SICAM P850 or SICAM P855 devices
MitigationSICAM P855siemens_psirt
Do not access links from untrusted sources while logged in at SICAM P850 or SICAM P855 devices
MitigationSICAM Tsiemens_psirt
Do not access links from untrusted sources while logged in at SICAM T
MitigationSICAM P850cisa_csaf_ot
Do not access links from untrusted sources while logged in at SICAM P850 or SICAM P855 devices
MitigationSICAM P855cisa_csaf_ot
Do not access links from untrusted sources while logged in at SICAM P850 or SICAM P855 devices

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · NCSC-NL NL

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · productcert@siemens.com DEAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.08.1highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-141USCWE-141USCWE-141USCWE-141USCWE-141USCWE-20US

betroffene Produkte (82)

Betroffene Produkte und Versionsbereiche.

Siemens SICAM P850 <3.00alle Versionencert_bundDE
Siemens SICAM P855 <3.00alle Versionencert_bundDE
Siemens SICAM T <V3.0alle Versionencert_bundDE
Siemens SICAM≤ P850 <3.00cert_bundDE
Siemens SICAM≤ P855 <3.00cert_bundDE
Siemens SICAM≤ T <V3.0cert_bundDE
SICAM P850alle Versionencisa_csaf_otUS
SICAM P855alle Versionencisa_csaf_otUS
Siemens SICAM P850< V3.00cisa_csaf_otUS
Siemens SICAM P855< V3.00cisa_csaf_otUS
Siemens SICAM T0 → V3.0enisa_euvdEU
Siemens AG SICAM P850≤ 3.0fstec_bduRU
Siemens AG SICAM P855≤ 3.0fstec_bduRU
Siemens Building X - Security Manager Edge Controller (ACC-AP)≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.4≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.4.5≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.5≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.5.2≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.6≤ vers:unknown/*ncsc_nlNL
Siemens Energy Services≤ vers:unknown/*ncsc_nlNL

20 von 82 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2025-0382Kwetsbaarheden verholpen in Siemens productenNL2025-12-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Building X, COMOS, Energy Services, Gridscale X, NX, RUGGEDCOM, SICAM, SIMATIC, SINEC, SINEMA, SIPLUS en Solid Edge.
SSA-165073SSA-165073: Multiple Vulnerabilities in the Webinterface of SICAM P850 and SICAM P855 Devices2022-05-10csaf · siemens_psirtDE
Multiple vulnerabilities were identified in the webserver of SICAM P850 and SICAM P855 devices. These include unauthenticated access to web-interface functionality, missing HTTPS or impersonation as well as cross-site scripting related vulnerabilities. Siemens has released updates for the affected products and recommends to update to the latest versions.
SSA-471761SSA-471761: Multiple Vulnerabilities in SICAM T Before V3.02025-12-09csaf · siemens_psirtDE
SICAM T before V3.0 contain multiple vulnerabilities. These include critical issues such as improper parameter and input validation, various Cross-Site Scripting (XSS) vulnerabilities , and a Cross-Site Request Forgery (CSRF) vulnerability . Additional weaknesses comprise session fixation, authentication and authorization bypasses , missing HTTPS protection, and missing cookie protection flags. These issues could potentially lead to remote code execution, denial of service, unauthorized access to web-interface functionality, session hijacking, impersonation of legitimate users, or allow an attacker to perform arbitrary actions on the device on behalf of a user. Siemens has released a new version for SICAM T and recommends to update to the latest version.
WID-SEC-W-2025-2767Siemens SICAM: Mehrere SchwachstellenDeutsch2022-05-09csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Siemens SICAM ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting Angriff durchzuführen.
ICSA-22-132-07Siemens SICAM P850 and SICAM P8552022-05-10icsa · cisa_csaf_otUS
Multiple vulnerabilities were identified in the webserver of SICAM P850 and SICAM P855 devices. These include unauthenticated access to web-interface functionality, missing HTTPS or impersonation as well as cross-site scripting related vulnerabilities. Siemens has released updates for the affected products and recommends to update to the latest versions.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-05-20geändert 2026-06-17

Referenzen (13)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan