Detections
Analytics
Siemens SICAM A8000 Missing Authentication For Critical Function (CVE-2022-27480)
high Tenable OT Security Plugin ID 500629
Synopsis
The remote OT asset is affected by a vulnerability.Description
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80).Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Siemens recommends updating the SICAM A8000 devices to v4.80 or later.
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to the Siemens operational guidelines for industrial security and follow the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory SSA-316850
See Also
https://cert-portal.siemens.com/productcert/pdf/ssa-316850.pdf
http://seclists.org/fulldisclosure/2022/Apr/20
http://www.nessus.org/u?42d5421e
https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-10
Plugin Details
Severity: High
ID: 500629
Version: 1.12
Type: remote
Family: Tenable.ot
Published: 4/19/2022
Updated: 11/27/2024
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2022-27480
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:siemens:sicam_a8000_cp-8050_firmware, cpe:/o:siemens:sicam_a8000_cp-8031_firmware
Required KB Items: Tenable.ot/Siemens
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/12/2022
Vulnerability Publication Date: 4/12/2022
Exploitable With
Core Impact
Reference Information
CVE: CVE-2022-27480