PT-2022-3243 · Siemens · Sicam P850+1

Published 2022-04-28 · Updated 2022-06-02 · CVE-2022-29881

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.00 SICAM P855 versions prior to V3.00

Description The web-based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details. The issue is related to the lack of authentication for a critical function, which may allow a remote attacker to disclose protected information.

Recommendations For SICAM P850 versions prior to V3.00, update to version V3.00 or later to resolve the issue. For SICAM P855 versions prior to V3.00, update to version V3.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-03947

CVE-2022-29881

Affected Products

Sicam P850

Sicam P855

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-29881 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03947 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29881 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-07 · Note
• https://vuldb.com/?id.200463 · Note
• https://t.me/cibsecurity/43056 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-165073.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2022051724 · Note