PT-2016-2998 · Siemens · Sicam Pas

Dmitry Sklyarov + 1 · Published 2016-12-05 · Updated 2023-10-17 · CVE-2016-8566

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SICAM PAS versions prior to 8.00

Description The issue is related to storing passwords in a recoverable format. An authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database. This could allow the attacker to gain access to the database.

Recommendations For versions prior to 8.00, update to version 8.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the database and limiting user privileges to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

CWE-257

Related Identifiers

BDU:2017-00009

CVE-2016-8566

Affected Products

Sicam Pas

References · 6

• https://bdu.fstec.ru/vul/2017-00009 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8566 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8566 · Vendor Advisory
• http://securityfocus.com/bid/94552 · Note
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-336-01 · Note