PT-2023-3769 · Siemens · Power Meter Sicam Q100+1

Published 2023-06-13 · Updated 2024-01-09 · CVE-2023-31238

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions POWER METER SICAM Q100 versions prior to V2.60 Siemens SICAM Q200 (affected versions not specified)

Description A vulnerability has been identified where affected devices are missing cookie protection flags when using the default settings. This allows an attacker who gains access to a session token to impersonate a legitimate application user. Additionally, there is an issue related to incorrect permission assignment for a critical resource in Siemens SICAM Q200, which can allow a remote attacker to elevate their privileges.

Recommendations For POWER METER SICAM Q100 versions prior to V2.60, update to version V2.60 or later to resolve the issue. For Siemens SICAM Q200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-04058

CVE-2023-31238

Affected Products

Power Meter Sicam Q100

Sicam Q200

References · 11

• https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04058 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31238 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-471761.html · Note
• https://cybersecurity-help.cz/vdb/SB2023061621 · Note
• https://vuldb.com/?id.231336 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-201498.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-480095.html · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-480095.pdf · Note
• https://cert-portal.siemens.com/productcert/html/ssa-887249.html · Note