What is CVE-2022-43546?

CVE-2022-43546 is a critical-severity vulnerability in Siemens 7kg9501-0aa01-2aa1, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2022-11-08.

How severe is CVE-2022-43546?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Improper input validation in Siemens 7kg9501-0aa01-2aa1

CVE-2022-43546

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the EndTime-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2022-11-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.016 (75.2th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: +0.001

Affected products

Siemens 7kg9501-0aa01-2aa1
Siemens 7kg9501-0aa01-2aa1 Firmware
Siemens 7kg9501-0aa31-2aa1
Siemens 7kg9501-0aa31-2aa1 Firmware
Siemens Power Meter Sicam Q100 — versions All versions < V2.50
Siemens Sicam P850 — versions All versions < V3.10
Siemens Sicam P855 — versions All versions < V3.10

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf
cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf (Patch, Mitigation, Vendor Advisory)
cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf

Frequently asked questions

What is CVE-2022-43546?: CVE-2022-43546 is a critical-severity vulnerability in Siemens 7kg9501-0aa01-2aa1, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2022-11-08.
How severe is CVE-2022-43546?: Critical severity. CVSS v3 base score is 9.9 out of 10.