Vulnerability · Published Apr 12, 2022 · Assigned by siemens
CVE-2022-27480
High 7.5
In plain English
A high-severity missing authorization in SICAM A8000 CP-8031 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SICAM A8000 CP-8031 | All versions < V4.80 |
| Siemens | SICAM A8000 CP-8050 | All versions < V4.80 |
Weakness: CWE-862
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-316850.pdf x_refsource_MISC
- 20220414 SEC Consult SA-20220413 :: Missing Authentication at File Download & Denial of Service in Siemens A8000 PLC mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html x_refsource_MISC