CVE-2020-10037: Out-of-bounds Read

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. By performing a flooding attack against the web server, an attacker might be able to gain read access to the device's memory, possibly revealing confidential information...

CVE-2020-10040: Use of Password Hash With Insufficient Computational Effort

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with local access to the device might be able to retrieve some passwords in clear text...

CVE-2020-10044: Missing Authentication for Critical Function

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the network could be able to install specially crafted firmware to the device...

CVE-2020-10042: Buffer Copy without Checking Size of Input

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network...

Siemens SICAM MMU, SICAM T, and SICAM SGU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM MMU, SICAM T and SICAM SGU Vulnerabilities: Out-of-bounds Read, Missing Authentication for Critical Function, Missing Encryption of Sensitive Data, Use of Password Hash wit...

PT-2020-11881

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified due to an error in the challenge-response procedure, which could allow an attacker to...

PT-2020-11873

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker to gain read access to the device's memory by performing a...

PT-2020-11877

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A stored Cross-Site-Scripting XSS issue is present in various parts of the web application, potentially allowing an attacke...

PT-2020-11875

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker in a privileged network position to conduct a...

PT-2020-11879

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A security issue has been identified that could allow Cross-Site Scripting XSS attacks. This occurs when unsuspecting users...

PT-2020-11874

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker with access to the device's web server to execute...

PT-2020-22540

Name of the Vulnerable Software and Affected Versions ZeroMQ affected versions not specified Description The issue is related to a bad-cast in the ZeroMQ library, specifically when casting to zmq::session base t from an invalid vptr. This occurs in the zmq::stream engine base t::in event internal...

PT-2020-11876

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker with local access to the device to retrieve some passwords...

PT-2020-11880

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker with network access to install specially crafted firmware ...

CVE-2020-10043: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. The web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link...

CVE-2020-10041: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A stored Cross-Site-Scripting XSS vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user...

CVE-2020-10039: Missing Encryption of Sensitive Data

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker in a privileged network position between a legitimate user and the web server might be able to conduct a Man-in-the-middle attack and gain read and write access to...

CVE-2020-10045: Authentication Bypass by Capture-replay

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application...

PT-2020-11878

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A buffer overflow issue exists in the web application of the affected software, potentially allowing an attacker with acces...

CVE-2020-10038: Missing Authentication for Critical Function

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the device's web server might be able to execute administrative commands without authentication...