PT-2021-7284 · Siemens · Power Meter Sicam Q100

Published 2021-12-14 · Updated 2021-12-16 · CVE-2021-44165

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions POWER METER SICAM Q100 versions prior to V2.41

Description A buffer overflow vulnerability has been identified in the web application of the affected firmware, which could allow a remote attacker with engineer or admin privileges to potentially perform remote code execution. The vulnerability is related to reading data beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

Recommendations For versions prior to V2.41, update to version V2.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2022-05148

CVE-2021-44165

Affected Products

Power Meter Sicam Q100

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-44165 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05148 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44165 · Vendor Advisory