Skip to content
OpenAdvisories
Medium ICSA-23-348-13 2 CVEs

Siemens SICAM Q100 Devices

Published Dec 12, 2023 · Updated Jan 9, 2024 · Revision 2

Vendor: Siemens Product: POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) Product: POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) Product: POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) Product: POWER METER SICAM Q100 (7KG9501-0AA31-2AA1)

Summary

The web server of SICAM Q100 devices, versions before V2.60, contains a Cross Site Request Forgery (CSRF) vulnerability and is missing cookie protection flags. This could allow an attacker to perform arbitrary actions on the device on behalf of a legitimate user, or impersonate that user.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 2

Revision history

  1. #2

    Added legacy Q100 device models (-0AA1) which are also affected and provide the same fix version

  2. #1

    Publication Date

References