Auth bypass in Siemens 7kg8500-0aa00-0aa0
CVE-2022-29877
A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings. However, the reconfigured settings cannot be activated unless the role of an authenticated administrator user.
Vulnerability class: Broken Authentication
EPSS: 0.006 (46.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Siemens 7kg8500-0aa00-0aa0
- Siemens 7kg8500-0aa00-0aa0_firmware
- Siemens 7kg8500-0aa00-2aa0
- Siemens 7kg8500-0aa00-2aa0_firmware
- Siemens 7kg8500-0aa10-0aa0
- Siemens 7kg8500-0aa10-0aa0_firmware
- Siemens 7kg8500-0aa10-2aa0
- Siemens 7kg8500-0aa10-2aa0_firmware
- Siemens 7kg8500-0aa30-0aa0
- Siemens 7kg8500-0aa30-0aa0_firmware
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-29877?
- CVE-2022-29877 is a medium-severity vulnerability in Siemens 7kg8500-0aa00-0aa0, classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2022-05-20.
- How severe is CVE-2022-29877?
- Medium severity. CVSS v3 base score is 6.5 out of 10.