High severity · published Apr 12, 2022
CVE-2022-27480
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80)
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sicam A8000 Cp-8031 Firmware · Siemens
before 4.80 · source: NVD
SA
Sicam A8000 Cp-8050 Firmware · Siemens
before 4.80 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-27480
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-27480
Third Party Advisory
http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
Mailing List
http://seclists.org/fulldisclosure/2022/Apr/20
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-316850.pdf
More from Sicam A8000 Cp-8031 Firmware
7.2
CVE-2023-42797
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20)