Critical ICSA-23-166-03 6 CVEs

Siemens SICAM Q200 Devices

Published Jun 13, 2023 · Updated May 6, 2025 · Revision 2

Vendor: Siemens Product: POWER METER SICAM Q200 family

Summary

Multiple vulnerabilities were identified in the webserver of Q200 devices. These include Cross Site Request Forgery (CSRF), session fixation, missing secure flags in HTTP cookies and memory corruption issues due to missing input validation that could lead to remote code execution.

Siemens has released an update for POWER METER SICAM Q200 family and recommends to update to the latest version.

Vulnerabilities 6

Critical 9.9

CVE-2022-43439

A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER …

Siemens SICAM T SICAM P855 SICAM P850 ICS / OT

Nov 8, 2022
Critical 9.9

CVE-2022-43545

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…

Siemens SICAM P850 SICAM P855 POWER METER SICAM Q100 ICS / OT

Nov 8, 2022
Critical 9.9

CVE-2022-43546

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…

Siemens SICAM P850 SICAM P855 POWER METER SICAM Q100 ICS / OT

Nov 8, 2022
High 7.5

CVE-2022-43398

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…

Siemens POWER METER SICAM Q100 ICS / OT

Nov 8, 2022
Medium 5.5

CVE-2023-31238

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…

Siemens SICAM T SICAM P855 SICAM P850 ICS / OT

Jun 13, 2023
Medium 4.3

CVE-2023-30901

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…

Siemens SICAM T SICAM P855 SICAM P850 ICS / OT

Jun 13, 2023

Revision history

2025-05-06 #2
Revision - Fixing typos
2023-06-13 #1
Publication Date

References

SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-887249.html
SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf
SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-887249.txt
ICS Advisory ICSA-23-166-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B