Summary
Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely:
-
SICAM A8000 device firmwares
- CPC80 for CP-8000/CP-8021/CP-8022
- CPCI85 and OPUPI0 for CP-8031/CP-8050
-
SICAM EGS firmware
- CPCI85 and OPUPI0
-
SICAM 8 Software Solution
- SICORE
Siemens has released new versions for the affected firmwares and recommends to update to the latest versions.
Vulnerabilities 3
-
High 7.8
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central P…
-
High 7.2
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base syst…
-
Medium 5.3
A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client…
Revision history
-
#2
Added Constantin Schieber-Knöbl and Stefan Viehböck to the acknowledgment
-
#1
Publication Date
References
-
SSA-871704: Multiple Vulnerabilities in SICAM Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-871704.html
-
SSA-871704: Multiple Vulnerabilities in SICAM Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-871704.pdf
-
SSA-871704: Multiple Vulnerabilities in SICAM Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-871704.txt
-
ICS Advisory ICSA-24-137-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B