Sign-up

ID

VAR-202205-0921


CVE

CVE-2022-29880


TITLE

Cross-site scripting vulnerability in multiple Siemens products

Trust: 0.8

sources: JVNDB: JVNDB-2022-010135

DESCRIPTION

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name of a logged user which accesses the affected views. 7kg8500-0aa00-0aa0 firmware, 7kg8500-0aa00-2aa0 firmware, 7kg8500-0aa10-0aa0 Multiple Siemens products such as firmware contain a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. The SICAM P850 multifunctional measuring device is used to acquire, visualize, evaluate and transmit electrical measurement variables such as alternating current, alternating voltage, frequency, power, harmonics, etc. The SICAM P855 multifunction device is used to collect, display and transmit measured electrical variables such as AC current, AC voltage, power type, harmonics, etc. Measured values and events are collected and processed according to the power quality standard IEC 61000-4-30. A security vulnerability exists in Siemens SICAM P850 and SICAM P855 Devices. Siemens SICAM P850 and SICAM P855

Trust: 2.25

sources: NVD: CVE-2022-29880 // JVNDB: JVNDB-2022-010135 // CNVD: CNVD-2022-36391 // VULMON: CVE-2022-29880

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-36391

AFFECTED PRODUCTS

vendor:siemensmodel:sicam p850scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:sicam p855scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:7kg8501-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:シーメンスmodel:7kg8501-0aa32-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa32-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-0aa0scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2022-36391 // JVNDB: JVNDB-2022-010135 // NVD: CVE-2022-29880

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-29880
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-29880
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-36391
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202205-3122
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-29880
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-36391
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-29880
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-29880
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-36391 // JVNDB: JVNDB-2022-010135 // CNNVD: CNNVD-202205-3122 // NVD: CVE-2022-29880

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010135 // NVD: CVE-2022-29880

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-3122

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202205-3122

PATCH

title:Patch for Siemens SICAM P850 and SICAM P855 Devices Cross-Site Scripting Vulnerability (CNVD-2022-36391)url:https://www.cnvd.org.cn/patchInfo/show/332566

Trust: 0.6

title:Siemens SICAM Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=194647

Trust: 0.6

sources: CNVD: CNVD-2022-36391 // CNNVD: CNNVD-202205-3122

EXTERNAL IDS

db:NVDid:CVE-2022-29880

Trust: 3.9

db:SIEMENSid:SSA-165073

Trust: 3.0

db:ICS CERTid:ICSA-22-132-07

Trust: 1.5

db:JVNid:JVNVU92977068

Trust: 0.8

db:JVNDBid:JVNDB-2022-010135

Trust: 0.8

db:CNVDid:CNVD-2022-36391

Trust: 0.6

db:AUSCERTid:ESB-2022.2357

Trust: 0.6

db:CS-HELPid:SB2022051724

Trust: 0.6

db:CNNVDid:CNNVD-202205-3122

Trust: 0.6

db:VULMONid:CVE-2022-29880

Trust: 0.1

sources: CNVD: CNVD-2022-36391 // VULMON: CVE-2022-29880 // JVNDB: JVNDB-2022-010135 // CNNVD: CNNVD-202205-3122 // NVD: CVE-2022-29880

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf

Trust: 2.4

url:https://jvn.jp/vu/jvnvu92977068/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-29880

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-07

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-165073.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051724

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-132-07

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-29880/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2357

Trust: 0.6

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-07

Trust: 0.1

sources: CNVD: CNVD-2022-36391 // VULMON: CVE-2022-29880 // JVNDB: JVNDB-2022-010135 // CNNVD: CNNVD-202205-3122 // NVD: CVE-2022-29880

CREDITS

Michael Messner from Siemens Energy reported these vulnerabilities to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202205-3122

SOURCES

db:CNVDid:CNVD-2022-36391
db:VULMONid:CVE-2022-29880
db:JVNDBid:JVNDB-2022-010135
db:CNNVDid:CNNVD-202205-3122
db:NVDid:CVE-2022-29880

LAST UPDATE DATE

2024-08-14T13:22:16.867000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-36391date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010135date:2023-08-10T08:25:00
db:CNNVDid:CNNVD-202205-3122date:2022-06-06T00:00:00
db:NVDid:CVE-2022-29880date:2022-06-02T14:04:00.253

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-36391date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010135date:2023-08-10T00:00:00
db:CNNVDid:CNNVD-202205-3122date:2022-05-12T00:00:00
db:NVDid:CVE-2022-29880date:2022-05-20T13:15:16.280