Critical SSA-572005 5 CVEs

SSA-572005: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices

Published Oct 11, 2022 · Updated Jun 13, 2023 · Revision 3

Vendor: Siemens Product: SICAM P850 (7KG8500-0AA00-0AA0) Product: SICAM P850 (7KG8500-0AA00-2AA0) Product: SICAM P850 (7KG8500-0AA10-0AA0) Product: SICAM P850 (7KG8500-0AA10-2AA0) Product: SICAM P850 (7KG8500-0AA30-0AA0) Product: SICAM P850 (7KG8500-0AA30-2AA0) Product: SICAM P850 (7KG8501-0AA01-0AA0) Product: SICAM P850 (7KG8501-0AA01-2AA0) Product: SICAM P850 (7KG8501-0AA02-0AA0) Product: SICAM P850 (7KG8501-0AA02-2AA0) Product: SICAM P850 (7KG8501-0AA11-0AA0) Product: SICAM P850 (7KG8501-0AA11-2AA0) Product: SICAM P850 (7KG8501-0AA12-0AA0) Product: SICAM P850 (7KG8501-0AA12-2AA0) Product: SICAM P850 (7KG8501-0AA31-0AA0) Product: SICAM P850 (7KG8501-0AA31-2AA0) Product: SICAM P850 (7KG8501-0AA32-0AA0) Product: SICAM P850 (7KG8501-0AA32-2AA0) Product: SICAM P855 (7KG8550-0AA00-0AA0) Product: SICAM P855 (7KG8550-0AA00-2AA0) Product: SICAM P855 (7KG8550-0AA10-0AA0) Product: SICAM P855 (7KG8550-0AA10-2AA0) Product: SICAM P855 (7KG8550-0AA30-0AA0) Product: SICAM P855 (7KG8550-0AA30-2AA0) Product: SICAM P855 (7KG8551-0AA01-0AA0) Product: SICAM P855 (7KG8551-0AA01-2AA0) Product: SICAM P855 (7KG8551-0AA02-0AA0) Product: SICAM P855 (7KG8551-0AA02-2AA0) Product: SICAM P855 (7KG8551-0AA11-0AA0) +7 more

Summary

Session fixation and multiple incorrect parameter parsing vulnerabilities that could potentially lead to remote code execution were identified in the web server of SICAM P850 and SICAM P855 devices.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 5

Critical 9.9

CVE-2022-43439

A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER …

Siemens SICAM T SICAM P855 SICAM P850 ICS / OT

Nov 8, 2022
Critical 9.9

CVE-2022-43545

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…

Siemens SICAM P850 SICAM P855 POWER METER SICAM Q100 ICS / OT

Nov 8, 2022
Critical 9.9

CVE-2022-43546

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…

Siemens SICAM P850 SICAM P855 POWER METER SICAM Q100 ICS / OT

Nov 8, 2022
Critical 9.8

CVE-2022-41665

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA0…

Siemens SICAM T SICAM P850 SICAM P855 ICS / OT

Oct 11, 2022
High 7.5

CVE-2022-40226

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA0…

Siemens SICAM T SICAM P850 SICAM P855 ICS / OT

Oct 11, 2022

Revision history

2023-06-13 #3
Added CVE-2022-43439, CVE-2022-43545 and CVE-2022-43546
2022-12-13 #2
Corrected description for CVE-2022-41665; corrected CVSS score for CVE-2022-40226
2022-10-11 #1
Publication Date

References

SSA-572005: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-572005.html
SSA-572005: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf
SSA-572005: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-572005.txt