PT-2016-2995 · Siemens · Sicam Pas

Published 2016-12-05 · Updated 2023-10-17 · CVE-2016-9157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SICAM PAS versions prior to V8.09

Description The issue is related to inadequate access control in the SICAM PAS telecontrol system, which could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution. This can be achieved by sending specially crafted packets to port 19234/TCP.

Recommendations For versions prior to V8.09, update to version V8.09 or later to resolve the issue. As a temporary workaround, consider restricting access to port 19234/TCP to minimize the risk of exploitation.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

BDU:2017-00006

CVE-2016-9157

Affected Products

Sicam Pas

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9157 · Security Note
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9157 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00006 · Security Note
• http://securityfocus.com/bid/94549 · Note