PT-2016-3179 · Siemens · Siemens Sicam Pas

Dmitry Sklyarov + 1 · Published 2016-01-15 · Updated 2023-10-17 · CVE-2016-5849

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens SICAM PAS versions prior to 8.07

Description The issue is related to insufficient password protection in databases, which could allow a local attacker with certain database privileges to calculate passwords. Additionally, it may enable local users to obtain sensitive configuration information by leveraging database stoppage.

Recommendations For Siemens SICAM PAS versions prior to 8.07, consider restricting access to the database to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit privileges for local users to prevent them from obtaining sensitive configuration information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-02204

CVE-2016-5849

Affected Products

Siemens Sicam Pas

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-5849 · Security Note
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-444217.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5849 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02204 · Security Note
• http://securitylab.ru/lab/PT-2016-29 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5849%20https://ics-cert.us-cert.gov/advisories/ICSA-16-182-02 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-182-02 · Note
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-444217.pdf%20http://securityfocus.com/bid/91525 · Note
• http://securityfocus.com/bid/91525 · Note