Sign-up

ID

VAR-202205-0924


CVE

CVE-2022-29881


TITLE

Lack of authentication for critical functions in multiple Siemens products

Trust: 0.8

sources: JVNDB: JVNDB-2022-010134

DESCRIPTION

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details. 7kg8500-0aa00-0aa0 firmware, 7kg8500-0aa00-2aa0 firmware, 7kg8500-0aa10-0aa0 Multiple Siemens products, such as firmware, are vulnerable to lack of authentication for critical functions.Information may be obtained. The SICAM P850 multifunctional measuring device is used to acquire, visualize, evaluate and transmit electrical measurement variables such as alternating current, alternating voltage, frequency, power, harmonics, etc. The SICAM P855 multifunction device is used to collect, display and transmit measured electrical variables such as AC current, AC voltage, power type, harmonics, etc. Measured values and events are collected and processed according to the power quality standard IEC 61000-4-30. Siemens SICAM P850 and SICAM P855

Trust: 2.25

sources: NVD: CVE-2022-29881 // JVNDB: JVNDB-2022-010134 // CNVD: CNVD-2022-36390 // VULMON: CVE-2022-29881

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-36390

AFFECTED PRODUCTS

vendor:siemensmodel:sicam p850scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:sicam p855scope:ltversion:v3.00

Trust: 10.8

vendor:siemensmodel:7kg8501-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa01-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa10-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa30-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa02-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8500-0aa10-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa32-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8501-0aa11-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8550-0aa00-0aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa31-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:siemensmodel:7kg8551-0aa12-2aa0scope:ltversion:3.00

Trust: 1.0

vendor:シーメンスmodel:7kg8501-0aa32-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa02-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa32-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa10-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa12-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8550-0aa00-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa11-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa31-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-2aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8500-0aa30-0aa0scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:7kg8501-0aa01-0aa0scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2022-36390 // JVNDB: JVNDB-2022-010134 // NVD: CVE-2022-29881

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-29881
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-29881
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-36390
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202205-3119
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-29881
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-36390
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-29881
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-29881
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-36390 // JVNDB: JVNDB-2022-010134 // CNNVD: CNNVD-202205-3119 // NVD: CVE-2022-29881

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:Lack of authentication for critical features (CWE-306) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010134 // NVD: CVE-2022-29881

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-3119

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202205-3119

PATCH

title:Patch for Siemens SICAM P850 and SICAM P855 Devices Authentication Vulnerability (CNVD-2022-36390)url:https://www.cnvd.org.cn/patchInfo/show/332561

Trust: 0.6

title:Siemens SICAM Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=194646

Trust: 0.6

sources: CNVD: CNVD-2022-36390 // CNNVD: CNNVD-202205-3119

EXTERNAL IDS

db:NVDid:CVE-2022-29881

Trust: 3.9

db:SIEMENSid:SSA-165073

Trust: 3.0

db:ICS CERTid:ICSA-22-132-07

Trust: 1.5

db:JVNid:JVNVU92977068

Trust: 0.8

db:JVNDBid:JVNDB-2022-010134

Trust: 0.8

db:CNVDid:CNVD-2022-36390

Trust: 0.6

db:AUSCERTid:ESB-2022.2357

Trust: 0.6

db:CS-HELPid:SB2022051724

Trust: 0.6

db:CNNVDid:CNNVD-202205-3119

Trust: 0.6

db:VULMONid:CVE-2022-29881

Trust: 0.1

sources: CNVD: CNVD-2022-36390 // VULMON: CVE-2022-29881 // JVNDB: JVNDB-2022-010134 // CNNVD: CNNVD-202205-3119 // NVD: CVE-2022-29881

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf

Trust: 2.4

url:https://jvn.jp/vu/jvnvu92977068/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-29881

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-07

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-165073.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051724

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-132-07

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-29881/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2357

Trust: 0.6

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-07

Trust: 0.1

sources: CNVD: CNVD-2022-36390 // VULMON: CVE-2022-29881 // JVNDB: JVNDB-2022-010134 // CNNVD: CNNVD-202205-3119 // NVD: CVE-2022-29881

CREDITS

Michael Messner from Siemens Energy reported these vulnerabilities to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202205-3119

SOURCES

db:CNVDid:CNVD-2022-36390
db:VULMONid:CVE-2022-29881
db:JVNDBid:JVNDB-2022-010134
db:CNNVDid:CNNVD-202205-3119
db:NVDid:CVE-2022-29881

LAST UPDATE DATE

2024-08-14T13:22:16.997000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-36390date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010134date:2023-08-10T08:25:00
db:CNNVDid:CNNVD-202205-3119date:2022-06-06T00:00:00
db:NVDid:CVE-2022-29881date:2022-06-02T14:05:14.107

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-36390date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-010134date:2023-08-10T00:00:00
db:CNNVDid:CNNVD-202205-3119date:2022-05-12T00:00:00
db:NVDid:CVE-2022-29881date:2022-05-20T13:15:16.327