PT-2022-12365 · Siemens · Sicam Pq Analyzer

Published 2022-01-11 · Updated 2022-01-18 · CVE-2021-45460

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICAM PQ Analyzer versions prior to V3.18

Description A service is started by an unquoted registry entry, which contains spaces in its path. This allows attackers with write privilege to those directories to potentially plant executables that will run in place of the legitimate process, leading to possible persistence on the system or a denial of service.

Recommendations For versions prior to V3.18, update to version V3.18 or later to resolve the issue. As a temporary workaround, consider restricting write access to the directories containing the unquoted registry entry to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2021-45460

Affected Products

Sicam Pq Analyzer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-45460 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-173318.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45460 · Vendor Advisory
• https://t.me/cibsecurity/35226 · Telegram Post