Summary
The CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 contains a hard-coded ID in the SSH
authorized_keys configuration file. An attacker with knowledge of the corresponding credential could login to the device via SSH. Only devices with activated debug support are affected.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Critical 9.8
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug s…
Revision history
-
#1
Publication Date
References
-
SSA-134651: Hard Coded SSH ID in CPCI85 Firmware of SICAM A8000 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-134651.html
-
SSA-134651: Hard Coded SSH ID in CPCI85 Firmware of SICAM A8000 Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-134651.pdf
-
SSA-134651: Hard Coded SSH ID in CPCI85 Firmware of SICAM A8000 Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-134651.txt