7Kg8500 0Aa00 0Aa0 Firmware CVE-2022-29878

HIGH

Authentication Bypass by Capture-replay (CWE-294)

2022-05-20 productcert@siemens.com

Information Disclosure 7Kg8500 0Aa00 0Aa0 Firmware 7Kg8500 0Aa00 2Aa0 Firmware 7Kg8500 0Aa10 0Aa0 Firmware 7Kg8500 0Aa10 2Aa0 Firmware 7Kg8500 0Aa30 0Aa0 Firmware 7Kg8500 0Aa30 2Aa0 Firmware 7Kg8501 0Aa01 0Aa0 Firmware 7Kg8501 0Aa01 2Aa0 Firmware 7Kg8501 0Aa02 0Aa0 Firmware 7Kg8501 0Aa02 2Aa0 Firmware 7Kg8501 0Aa11 0Aa0 Firmware 7Kg8501 0Aa11 2Aa0 Firmware 7Kg8501 0Aa12 0Aa0 Firmware 7Kg8501 0Aa12 2Aa0 Firmware 7Kg8501 0Aa31 0Aa0 Firmware 7Kg8501 0Aa31 2Aa0 Firmware 7Kg8501 0Aa32 0Aa0 Firmware 7Kg8501 0Aa32 2Aa0 Firmware 7Kg8550 0Aa00 0Aa0 Firmware 7Kg8550 0Aa00 2Aa0 Firmware 7Kg8550 0Aa10 0Aa0 Firmware 7Kg8550 0Aa10 2Aa0 Firmware 7Kg8550 0Aa30 0Aa0 Firmware 7Kg8550 0Aa30 2Aa0 Firmware 7Kg8551 0Aa01 0Aa0 Firmware 7Kg8551 0Aa01 2Aa0 Firmware 7Kg8551 0Aa02 0Aa0 Firmware 7Kg8551 0Aa02 2Aa0 Firmware 7Kg8551 0Aa11 0Aa0 Firmware 7Kg8551 0Aa11 2Aa0 Firmware 7Kg8551 0Aa12 0Aa0 Firmware 7Kg8551 0Aa12 2Aa0 Firmware 7Kg8551 0Aa31 0Aa0 Firmware 7Kg8551 0Aa31 2Aa0 Firmware 7Kg8551 0Aa32 0Aa0 Firmware 7Kg8551 0Aa32 2Aa0 Firmware

7.5

CVSS 3.1 · Vendor: siemens

Share

Severity by source

Vendor (siemens) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (siemens) · only source for this CVE.

CVSS VectorVendor: siemens

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

May 20, 2022 - 13:15 cve.org

HIGH 7.5

DescriptionCVE.org

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device.

AnalysisAI

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-294. A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device. Affected products include: Siemens 7Kg8500-0Aa00-0Aa0 Firmware, Siemens 7Kg8500-0Aa00-2Aa0 Firmware, Siemens 7Kg8500-0Aa10-0Aa0 Firmware, Siemens 7Kg8500-0Aa10-2Aa0 Firmware, Siemens 7Kg8500-0Aa30-0Aa0 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in 7Kg8500 0Aa00 0Aa0 Firmware

View all

CVE-2022-29873 CRITICAL Act Now

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated critical severity (CVSS 9.3), this vulnerabi

CVE-2022-41665 HIGH This Week

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00

CVE-2022-29874 HIGH This Week

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 8.8), this vulnerability

CVE-2022-29872 HIGH This Week

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 8.7), this vulnerability

CVE-2022-40226 HIGH This Week

A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00

CVE-2022-29882 HIGH This Week

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 7.1), this vulnerability

CVE-2022-29876 HIGH This Week

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 7.1), this vulnerability

CVE-2022-29883 MEDIUM This Month

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated medium severity (CVSS 6.9), this vulnerabili

CVE-2022-29881 MEDIUM This Month

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated medium severity (CVSS 6.9), this vulnerabili

CVE-2022-29880 MEDIUM This Month

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated medium severity (CVSS 6.5), this vulnerabili

CVE-2022-29877 MEDIUM This Month

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850

CVE-2022-29879 MEDIUM This Month

A vulnerability has been identified in SICAM T (All versions < V3.0). Rated medium severity (CVSS 5.3), this vulnerabili

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all

CVE-2017-3191 CRITICAL

CVE-2017-6823 HIGH POC

CVE-2023-1886 CRITICAL POC

CVE-2023-1537 CRITICAL POC

CVE-2022-29334 CRITICAL POC

CVE-2021-27289 CRITICAL POC

CVE-2022-31277 HIGH POC

CVE-2022-31265 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2022-29878 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy