PT-2022-2737 · Siemens · Sicam P850+1

Published 2022-04-28 · Updated 2022-05-26 · CVE-2022-29874

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.00 SICAM P855 versions prior to V3.00

Description A vulnerability has been identified in the affected devices, which do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allow an unauthenticated attacker to capture the traffic and interfere with the functionality of the device.

Recommendations For SICAM P850 versions prior to V3.00, update to version V3.00 or later to resolve the issue. For SICAM P855 versions prior to V3.00, update to version V3.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the device via HTTP to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2022-03243

CVE-2022-29874

Affected Products

Sicam P850

Sicam P855

References · 10

• https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03243 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29874 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29874 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-07 · Note
• https://t.me/cibsecurity/43046 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-165073.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2022051724 · Note
• https://vuldb.com/ru/?id.200460 · Note