Description
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default.
The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | CP-8031 MASTER MODULE | All versions < CPCI85 V05 | — |
| Siemens | CP-8050 MASTER MODULE | All versions < CPCI85 V05 | — |
Advisories 3
- ICSA-23-103-07 Siemens CPCI85 Firmware of SICAM A8000 Devices CISA ICS & IT advisories · Apr 11, 2023
- SSA-472454 SSA-472454: Command Injection Vulnerability in CPCI85 Firmware of SICAM A8000 Devices Siemens ProductCERT · Apr 11, 2023
- WID-SEC-2023-0908 Siemens SICAM A8000 Geräte: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Apr 10, 2023