High WID-SEC-2023-2603 7 CVEs

Siemens SICAM: Mehrere Schwachstellen

Published Oct 9, 2023 · Updated Oct 9, 2023 · de-DE

Vendor: Siemens Product: SICAM Product: SICAM A8000 Product: SICAM CP Product: SICAM HMI Comfort Outdoor Panels Product: SICAM HMI KTP Mobile Panels Product: SICAM NET PC Software Product: SICAM PAS Product: SICAM PQS

Summary

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Siemens SICAM ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.

Product

Siemens SICAM ist eine Produktfamilie von SCADA-Systemen für den Betrieb von industriellen Prozessen.

Vulnerabilities 7

Critical 9.8

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug s…

Siemens CP-8031 MASTER MODULE CP-8050 MASTER MODULE ICS / OT

Oct 10, 2023
High 7.8

CVE-2023-45205

A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is insta…

Siemens SICAM PAS/PQS ICS / OT

Oct 10, 2023
High 7.5

CVE-2023-42796

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All…

Siemens CP-8031 MASTER MODULE CP-8050 MASTER MODULE ICS / OT

Oct 10, 2023
Medium 6.7

CVE-2023-37194

A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …

Siemens SIMATIC CP 1604 SIMATIC CP 1616 SIMATIC CP 1626 ICS / OT

Oct 10, 2023
Medium 6.6

CVE-2023-38640

A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is insta…

Siemens SICAM PAS/PQS ICS / OT

Oct 10, 2023
Medium 4.4

CVE-2023-37195

A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …

Siemens SIMATIC CP 1604 SIMATIC CP 1616 SIMATIC CP 1626 ICS / OT

Oct 10, 2023
Unscored —

CVE-2021-45117

The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL point…

Mar 21, 2022

Revision history

2023-10-09 #1
Initiale Fassung

References

Siemens Security Advisory vom 2023-10-09
https://cert-portal.siemens.com/productcert/html/ssa-285795.html
Siemens Security Advisory vom 2023-10-09
https://cert-portal.siemens.com/productcert/html/ssa-784849.html
Siemens Security Advisory vom 2023-10-09
https://cert-portal.siemens.com/productcert/html/ssa-770890.html
Siemens Security Advisory vom 2023-10-09
https://cert-portal.siemens.com/productcert/html/ssa-134651.html
Siemens Security Advisory vom 2023-10-09
https://cert-portal.siemens.com/productcert/html/ssa-035466.html