Sign-up

ID

VAR-202205-0919


CVE

CVE-2022-29877


TITLE

Lack of authentication for critical functions in multiple Siemens products

Trust: 0.8

sources: JVNDB: JVNDB-2022-010138

DESCRIPTION

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings. However, the reconfigured settings cannot be activated unless the role of an authenticated administrator user. 7kg8500-0aa00-0aa0 firmware, 7kg8500-0aa00-2aa0 firmware, 7kg8500-0aa10-0aa0 Multiple Siemens products, such as firmware, are vulnerable to lack of authentication for critical functions.Information may be obtained and information may be tampered with. The SICAM P850 multifunctional measuring device is used to acquire, visualize, evaluate and transmit electrical measurement variables such as alternating current, alternating voltage, frequency, power, harmonics, etc. The SICAM P855 multifunction device is used to collect, display and transmit measured electrical variables such as AC current, AC voltage, power type, harmonics, etc. Measured values and events are collected and processed according to the power quality standard IEC 61000-4-30. Siemens SICAM P850 and SICAM P855

Trust: 2.25

sources: NVD: CVE-2022-29877 // JVNDB: JVNDB-2022-010138 // CNVD: CNVD-2022-36394 // VULMON: CVE-2022-29877

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-36394

AFFECTED PRODUCTS

vendor:siemensmodel:sicam p850scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:sicam p855scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:7kg8501-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:シーメンスmodel:7kg8501-0aa32-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa32-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-0aa0scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2022-36394 // JVNDB: JVNDB-2022-010138 // NVD: CVE-2022-29877

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-29877
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-29877
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-36394
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202205-3126
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-29877
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-36394
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-29877
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.5
version: 3.1

Trust: 1.0

NVD: CVE-2022-29877
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-36394 // JVNDB: JVNDB-2022-010138 // CNNVD: CNNVD-202205-3126 // NVD: CVE-2022-29877

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:Lack of authentication for critical features (CWE-306) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010138 // NVD: CVE-2022-29877

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-3126

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202205-3126

PATCH

title:Patch for Siemens SICAM P850 and SICAM P855 Devices Authentication Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/332536

Trust: 0.6

title:Siemens SICAM Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=194650

Trust: 0.6

sources: CNVD: CNVD-2022-36394 // CNNVD: CNNVD-202205-3126

EXTERNAL IDS

db:NVDid:CVE-2022-29877

Trust: 3.9

db:SIEMENSid:SSA-165073

Trust: 3.0

db:ICS CERTid:ICSA-22-132-07

Trust: 1.5

db:JVNid:JVNVU92977068

Trust: 0.8

db:JVNDBid:JVNDB-2022-010138

Trust: 0.8

db:CNVDid:CNVD-2022-36394

Trust: 0.6

db:AUSCERTid:ESB-2022.2357

Trust: 0.6

db:CS-HELPid:SB2022051724

Trust: 0.6

db:CNNVDid:CNNVD-202205-3126

Trust: 0.6

db:VULMONid:CVE-2022-29877

Trust: 0.1

sources: CNVD: CNVD-2022-36394 // VULMON: CVE-2022-29877 // JVNDB: JVNDB-2022-010138 // CNNVD: CNNVD-202205-3126 // NVD: CVE-2022-29877

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf

Trust: 2.4

url:https://jvn.jp/vu/jvnvu92977068/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-29877

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-07

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-165073.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051724

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-132-07

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-29877/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2357

Trust: 0.6

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-07

Trust: 0.1

sources: CNVD: CNVD-2022-36394 // VULMON: CVE-2022-29877 // JVNDB: JVNDB-2022-010138 // CNNVD: CNNVD-202205-3126 // NVD: CVE-2022-29877

CREDITS

Michael Messner from Siemens Energy reported these vulnerabilities to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202205-3126

SOURCES

db:CNVDid:CNVD-2022-36394
db:VULMONid:CVE-2022-29877
db:JVNDBid:JVNDB-2022-010138
db:CNNVDid:CNNVD-202205-3126
db:NVDid:CVE-2022-29877

LAST UPDATE DATE

2024-08-14T13:22:16.899000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-36394date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010138date:2023-08-10T08:25:00
db:CNNVDid:CNNVD-202205-3126date:2022-06-06T00:00:00
db:NVDid:CVE-2022-29877date:2022-06-02T13:50:40.090

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-36394date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010138date:2023-08-10T00:00:00
db:CNNVDid:CNNVD-202205-3126date:2022-05-12T00:00:00
db:NVDid:CVE-2022-29877date:2022-05-20T13:15:16.130