Summary
Multiple vulnerabilities were identified in the webserver of Q200 devices. These include Cross Site Request Forgery (CSRF), session fixation, missing secure flags in HTTP cookies and memory corruption issues due to missing input validation that could lead to remote code execution.
Siemens has released an update for POWER METER SICAM Q200 family and recommends to update to the latest version.
Vulnerabilities 6
-
Critical 9.9
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER …
-
Critical 9.9
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…
-
Critical 9.9
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…
-
High 7.5
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…
-
Medium 5.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
-
Medium 4.3
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
Revision history
-
#1
Publication Date
References
-
SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-887249.html
-
SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf
-
SSA-887249: Multiple Vulnerabilities in the Web Interface of SICAM Q200 Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-887249.txt