PT-2022-2756 · Siemens · Siemens Sicam P850+1

Published 2022-04-28 · Updated 2022-06-02 · CVE-2022-29882

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens SICAM P850 versions prior to V3.00 Siemens SICAM P855 versions prior to V3.00

Description The issue is related to the handling of uploaded files, which can be exploited by an unauthenticated attacker to store an XSS attack. When a legitimate user accesses the error logs, the attacker could perform arbitrary actions in the name of the user. This situation can lead to inter-site script attacks.

Recommendations For Siemens SICAM P850 versions prior to V3.00, update to version V3.00 or later to resolve the issue. For Siemens SICAM P855 versions prior to V3.00, update to version V3.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the error logs until a patch is available. Avoid using the affected devices for sensitive operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-03273

CVE-2022-29882

Affected Products

Siemens Sicam P850

Siemens Sicam P855

References · 10

• https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03273 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29882 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29882 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-07 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-165073.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2022051724 · Note
• https://t.me/cibsecurity/43051 · Telegram Post
• https://vuldb.com/?id.200467 · Note