Missing Authentication for Critical Function in Siemens products - CVE-2022-30229
Published: June 15, 2022
Vulnerability identifier: #VU64393
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-30229
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected software does not require authenticated access for privileged functions. A remote attacker can change data of an user, such as credentials, in case that user's id is known.
Affected software
SICAM GridEdge Essential ARM
SICAM GridEdge Essential Intel
SICAM GridEdge Essential with GDS ARM
SICAM GridEdge Essential with GDS Intel
SICAM GridEdge Essential Intel
SICAM GridEdge Essential with GDS ARM
SICAM GridEdge Essential with GDS Intel
How to mitigate CVE-2022-30229
Install updates from vendor's website.
SICAM GridEdge Essential ARM - update to 2.6.6
SICAM GridEdge Essential Intel - update to 2.6.6
SICAM GridEdge Essential with GDS ARM - update to 2.6.6
SICAM GridEdge Essential with GDS Intel - update to 2.6.6
SICAM GridEdge Essential Intel - update to 2.6.6
SICAM GridEdge Essential with GDS ARM - update to 2.6.6
SICAM GridEdge Essential with GDS Intel - update to 2.6.6