PT-2023-3379 · Siemens · Cp-8050 Master Module +1

Name of the Vulnerable Software and Affected Versions: CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05 Description: A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker...

Siemens SICAM A8000 Devices

​​As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services ...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in SIMATIC, SICAM, SIMOTION, WinCC, Solid Edge and Scalance products. The vulnerabilities allow a malicious party potentially capable of carrying out attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data...

Siemens SICAM P850 and SICAM P855 Cleartext Transmission of Sensitive Information (CVE-2022-29874)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allow an unauthenticated attacker to capture the traffic and interfere with the...

Siemens SICAM P850 and P855 Devices Session Fixation (CVE-2022-40226)

A vulnerability has been identified in SICAM P850 All versions V3.10, SICAM P855 All versions V3.10. Affected devices accept user defined session cookies and do not renew the session cookie after login/logout. This could allow an attacker to take over another user's session after login. This plug...

Siemens SICAM P850 and SICAM P855 Missing Authentication For Critical Function (CVE-2022-29881)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal...

Siemens SICAM P850 and SICAM P855 Improper Authentication (CVE-2022-29883)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication. This plugin only works with...

Siemens SICAM P850 and SICAM P855 Missing Authentication For Critical Function (CVE-2022-29877)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Input During Web Page Generation (CVE-2022-29882)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses th...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Input During Web Page Generation (CVE-2022-29880)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name ...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Input During Web Page Generation (CVE-2022-29876)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker t...

Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Parameter/Argument Delimiters (CVE-2022-29873)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the...

Siemens SICAM P850 and SICAM P855 Missing Authentication For Critical Function (CVE-2022-29879)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical devic...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Parameter/Argument Delimiters (CVE-2022-29872)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not properly validate parameters of POST requests. This could allow an authenticated attacker to set the device to a denial of service state or to control the program counter...

Siemens SICAM P850 and P855 Devices Improper Neutralization of Parameter/Argument Delimiters (CVE-2022-41665)

A vulnerability has been identified in SICAM P850 All versions V3.10, SICAM P855 All versions V3.10. Affected devices do not properly validate the parameter of a specific GET request. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the...

Siemens CPCI85 Firmware of SICAM A8000 Devices Improper Neutralization of Special Elements Used in a Command (CVE-2023-28489)

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter Remote Operation is enabled. The parameter is disabled by...

Siemens SICAM Q100 Session Fixation (CVE-2022-43398)

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...

Siemens SICAM A8000 Use of Hard-Coded Credentials (CVE-2021-45033)

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70C All versions V16.20, CP-8000 MASTER MODULE WITH I/O -40/+70C All versions V16.20, CP-8021 MASTER MODULE All versions V16.20, CP-8022 MASTER MODULE WITH GPRS All versions V16.20. An undocumented debug port uses hard-cod...

Siemens SICAM Q100 Improper Input Validation (CVE-2022-43545)

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, SICAM P850 All versions V3.10, SICAM P850 All versions V3.10, SICAM P850 All versions...