Medium severity · published May 10, 2022
CVE-2022-29881
A vulnerability has been identified in SICAM T (All versions < V3.0)
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
SICAM T · Siemens
before V3.0 · source: vendor
7F
7kg8500-0aa00-0aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8500-0aa00-2aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8500-0aa10-0aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8500-0aa10-2aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8500-0aa30-0aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8500-0aa30-2aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8501-0aa01-0aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8501-0aa01-2aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8501-0aa02-0aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8501-0aa02-2aa0 Firmware · Siemens
before 3.00 · source: NVD
7F
7kg8501-0aa11-0aa0 Firmware · Siemens
before 3.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29881
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-165073.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-471761.html
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
More from SICAM T
9.8
CVE-2022-29873
A vulnerability has been identified in SICAM T (All versions < V3.0)
8.8
CVE-2023-30901
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P850…
8.8
CVE-2022-43439
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions < V2.50),…
8.8
CVE-2022-41665
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850…
8.8
CVE-2022-29874
A vulnerability has been identified in SICAM T (All versions < V3.0)