PT-2022-26884 · Unknown · Power Meter Sicam Q100

Published 2022-11-08 · Updated 2024-01-09 · CVE-2022-43398

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions POWER METER SICAM Q100 versions prior to V2.50

Description A vulnerability has been identified where affected devices do not renew the session cookie after login/logout and also accept user-defined session cookies. An attacker could overwrite the stored session cookie of a user, gaining access to the user's account through the activated session after the victim logs in.

Recommendations For versions prior to V2.50, update to version V2.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the session cookie management functionality until a patch is available. Avoid using user-defined session cookies in the affected devices until the issue is resolved.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-43398

Affected Products

Power Meter Sicam Q100

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43398 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf · Note
• https://t.me/cibsecurity/52636 · Telegram Post