Critical severity · published Aug 14, 2020
CVE-2020-15781
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30)
9.6
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sicam A8000 Firmware · Siemens
before 05.30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15781
Mitigation
https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf
More from Sicam A8000 Firmware
7.5
CVE-2024-34057
Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages