Multiple vulnerabilities in Siemens SICAM MMU, SICAM T, and SICAM SGU

1) Out-of-bounds read

EUVDB-ID: #VU30144

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10037

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can perform a flood attack against the web server, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing Authentication for Critical Function

EUVDB-ID: #VU30145

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10038

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due missing authentication for critical function. A remote attacker with access to the device’s web server can execute administrative commands without authentication.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Missing Encryption of Sensitive Data

EUVDB-ID: #VU30146

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10039

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing encryption of sensitive data. A remote attacker in a privileged network position between a legitimate user and the web server can conduct a man-in-the-middle attack and gain read and write access to the transmitted data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of Password Hash With Insufficient Computational Effort

EUVDB-ID: #VU30258

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10040

CWE-ID: CWE-916 - Use of Password Hash With Insufficient Computational Effort

Exploit availability: No

Description

The vulnerability allows a local attacker to access sensitive information on the target system.

The vulnerability exists due to usage of password hash with insufficient computational effort. A local attacker can retrieve passwords in clear text. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stored cross-site scripting

EUVDB-ID: #VU30264

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10041

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in different locations of the web application. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU30278

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10042

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Cross-site scripting

EUVDB-ID: #VU30291

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10043

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Missing Authentication for Critical Function

EUVDB-ID: #VU30297

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10044

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the targte system.

The vulnerability exists due missing authentication for critical function. A remote attacker can install specially crafted firmware on the device.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Authentication Bypass by Capture-replay

EUVDB-ID: #VU30305

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10045

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication on the target system.

The vulnerability exists due to improper authentication process. A remote attacker can replay authentication traffic and gain access to protected areas of the web application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SICAM MMU: before 2.05

SICAM SGU: All versions

SICAM T: before 2.18

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.