Lucene search

SiemensCVELIST:CVE-2022-43398

HistoryNov 08, 2022 - 12:00 a.m.

CVE-2022-43398

2022-11-0800:00:00

CWE-384

siemens

www.cve.org

vulnerability

power meter sicam q100

session cookie

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user’s account through the activated session.

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "POWER METER SICAM Q100",
    "versions": [
      {
        "version": "All versions < V2.50",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "POWER METER SICAM Q100",
    "versions": [
      {
        "version": "All versions < V2.50",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "POWER METER SICAM Q100",
    "versions": [
      {
        "version": "All versions < V2.50",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "POWER METER SICAM Q100",
    "versions": [
      {
        "version": "All versions < V2.50",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf

cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

Related for CVELIST:CVE-2022-43398