PT-2022-2762 · Siemens · Sicam P850+1

Published 2022-04-28 · Updated 2022-05-26 · CVE-2022-29876

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.00 SICAM P855 versions prior to V3.00

Description A vulnerability has been identified in the affected devices, which do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response, allowing an unauthenticated attacker to perform reflected XSS attacks. This issue is related to insufficient cleaning of user data in the GET request parameter, which could enable a remote attacker to conduct cross-site scripting attacks using a specially crafted link.

Recommendations For SICAM P850 versions prior to V3.00, update to version V3.00 or later to resolve the issue. For SICAM P855 versions prior to V3.00, update to version V3.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected devices to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected GET request until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-03281

CVE-2022-29876

Affected Products

Sicam P850

Sicam P855

References · 9

• https://osv.dev/vulnerability/CVE-2022-29876 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29876 · Security Note
• https://bdu.fstec.ru/vul/2022-03281 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-07 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-165073.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2022051724 · Note
• https://vuldb.com/?id.200465 · Note