Vulnerability · Published Nov 8, 2022 · Assigned by siemens
CVE-2022-43398
High 7.5
In plain English
A high-severity session fixation in POWER METER SICAM Q100 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | POWER METER SICAM Q100 | All versions < V2.50 |
| Siemens | POWER METER SICAM Q100 | All versions < V2.50 |
| Siemens | POWER METER SICAM Q100 | All versions < V2.50 |
| Siemens | POWER METER SICAM Q100 | All versions < V2.50 |
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C