CVE-2022-43398

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf	Mitigation Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:siemens:7kg9501-0aa01-2aa1:-:*:*:*:*:*:*:*

cpe:2.3:o:siemens:7kg9501-0aa01-2aa1_firmware:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:h:siemens:7kg9501-0aa31-2aa1:-:*:*:*:*:*:*:*

cpe:2.3:o:siemens:7kg9501-0aa31-2aa1_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-11-08 11:15

Updated : 2024-01-09 10:15

NVD link : CVE-2022-43398

Mitre link : CVE-2022-43398

CVE.ORG link : CVE-2022-43398

JSON object : View

Products Affected

siemens

7kg9501-0aa01-2aa1
7kg9501-0aa01-2aa1_firmware
7kg9501-0aa31-2aa1
7kg9501-0aa31-2aa1_firmware

CWE

CWE-384

Session Fixation

{"id": "CVE-2022-43398", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2022-11-08T11:15:11.940", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf", "source": "productcert@siemens.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la familia POWER METER SICAM Q200 (Todas las versiones < V2.70). Los dispositivos afectados no renuevan la cookie de sesi\u00f3n despu\u00e9s de iniciar/cerrar sesi\u00f3n y tambi\u00e9n aceptan cookies de sesi\u00f3n definidas por el usuario. Un atacante podr\u00eda sobrescribir la cookie de sesi\u00f3n almacenada de un usuario. Despu\u00e9s de que la v\u00edctima inicia sesi\u00f3n, el atacante obtiene acceso a la cuenta del usuario a trav\u00e9s de la sesi\u00f3n activada."}], "lastModified": "2024-01-09T10:15:14.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:7kg9501-0aa01-2aa1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "275E9296-AACA-4F3B-B8FA-D52A59E729DE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:7kg9501-0aa01-2aa1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "821380FC-8F3A-4437-94FF-FB95D9F187D0", "versionEndExcluding": "2.50"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:7kg9501-0aa31-2aa1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DC260D4F-53BD-433C-AE8F-FA2FA47BC921"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:7kg9501-0aa31-2aa1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEE155DF-AB9B-4A85-A845-AF1B51B05833", "versionEndExcluding": "2.50"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}