PT-2022-25294 · Siemens · Sicam P850+1

Published 2022-10-11 · Updated 2023-06-13 · CVE-2022-40226

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.10 SICAM P855 versions prior to V3.10

Description A vulnerability has been identified in the affected devices, which accept user-defined session cookies and do not renew the session cookie after login/logout. This could allow an attacker to take over another user's session after login.

Recommendations For SICAM P850 versions prior to V3.10, update to version V3.10 or later to resolve the issue. For SICAM P855 versions prior to V3.10, update to version V3.10 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of session takeover until a patch is available.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-40226

Affected Products

Sicam P850

Sicam P855

References · 6

• https://osv.dev/vulnerability/CVE-2022-40226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40226 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-572005.html · Note
• https://t.me/cibsecurity/51103 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note