PT-2022-26016 · Siemens · Sicam P850+1

Published 2022-10-11 · Updated 2023-06-13 · CVE-2022-41665

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.10 SICAM P855 versions prior to V3.10

Description The affected devices do not properly validate the parameter of a specific GET request. This could allow an attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.

Recommendations For SICAM P850 versions prior to V3.10, update to version V3.10 or later. For SICAM P855 versions prior to V3.10, update to version V3.10 or later. As a temporary workaround, consider restricting access to the vulnerable GET request endpoint until a patch is available.

Fix

Weakness Enumeration

CWE-141

Related Identifiers

CVE-2022-41665

Affected Products

Sicam P850

Sicam P855

References · 6

• https://osv.dev/vulnerability/CVE-2022-41665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41665 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf · Vendor Advisory
• https://t.me/cibsecurity/51102 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-572005.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note