Summary
The web server of SICAM Q100 devices, versions before V2.60, contains a Cross Site Request Forgery (CSRF) vulnerability and is missing cookie protection flags. This could allow an attacker to perform arbitrary actions on the device on behalf of a legitimate user, or impersonate that user.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 2
-
Medium 5.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
-
Medium 4.3
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
Revision history
-
#2
Added legacy Q100 device models (-0AA1) which are also affected and provide the same fix version
-
#1
Publication Date
References
-
SSA-480095: Vulnerabilities in the Web Interface of SICAM Q100 Devices before V2.60 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-480095.html
-
SSA-480095: Vulnerabilities in the Web Interface of SICAM Q100 Devices before V2.60 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-480095.pdf
-
SSA-480095: Vulnerabilities in the Web Interface of SICAM Q100 Devices before V2.60 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-480095.txt