Siemens SICAM PAS/PQS 安全漏洞

Siemens SICAM PAS/PQS is a software from Siemens with an operating system for energy automation and power quality. Siemens SICAM PAS/PQS suffers from an incorrect privilege assignment vulnerability that can be exploited to inject arbitrary code and elevate privileges to NT AUTHORITY/SYSTEM...

CVE-2022-43723

CVE-2022-43723 affects Siemens SICAM PAS/PQS where the s7ontcp.dll fails to properly validate a certain input parameter. This allows an unauthenticated remote attacker to send messages and trigger a denial-of-service by crashing the application. Public details in multiple sources confirm affected...

CVE-2022-43724

CVE-2022-43724 affects Siemens SICAM PAS/PQS prior to V7.0. The vulnerability arises because the software transmits database credentials for the built-in SQL server in cleartext, and with default-enabled xp_cmdshell, an unauthenticated remote attacker could execute arbitrary OS commands. The issu...