PT-2022-27016 · Unknown · Sicam Pas/Pqs

Published 2022-12-13 · Updated 2023-10-17 · CVE-2022-43722

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICAM PAS/PQS versions prior to V7.0

Description A vulnerability has been identified where the affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder, which is then run with SYSTEM rights when a service is started that requires this DLL. The affected firmware version of the component has already been superseded by succeeding mainline versions.

Recommendations For versions prior to V7.0, update to version V7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the folder containing library files to prevent an attacker from placing a custom malicious DLL.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2022-43722

Affected Products

Sicam Pas/Pqs

References · 4

• https://osv.dev/vulnerability/CVE-2022-43722 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-849072.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43722 · Security Note
• https://t.me/cibsecurity/54439 · Telegram Post