PT-2022-3225 · Siemens · Sicam P850+1

Published 2022-04-28 · Updated 2022-06-02 · CVE-2022-29880

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.00 SICAM P855 versions prior to V3.00

Description The issue is related to the configuration interface of the affected devices, which do not properly validate input. This could allow an authenticated attacker to perform arbitrary actions in the name of a logged user who accesses the affected views by placing persistent XSS attacks.

Recommendations For SICAM P850 versions prior to V3.00, update to version V3.00 or later. For SICAM P855 versions prior to V3.00, update to version V3.00 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-03927

CVE-2022-29880

Affected Products

Sicam P850

Sicam P855

References · 10

• https://osv.dev/vulnerability/CVE-2022-29880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29880 · Security Note
• https://bdu.fstec.ru/vul/2022-03927 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-07 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-165073.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2022051724 · Note
• https://t.me/cibsecurity/43048 · Telegram Post
• https://vuldb.com/?id.200466 · Note