Summary
SICAM PAS/PQS is affected by insecure permission assignments in application folders that could allow an authenticated local attacker to read and modify configuration data or to escalate privileges.
Siemens has released a new version for SICAM PAS/PQS and recommends to update to the latest version.
Siemens has also released a security patch that can be applied to previous versions to fix the permissions of the impacted folders. See also chapter
Additional Information.
Vulnerabilities 2
-
High 7.8
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is insta…
-
Medium 6.6
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is insta…
Revision history
-
#2
Added fix release for SICAM PAS/PQS for CVE-2023-38640
-
#1
Publication Date
References
-
SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-035466.html
-
SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf
-
SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-035466.txt
-
ICS Advisory ICSA-23-285-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-06
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B