A vulnerability has been found in Siemens SICAM PAS and SICAM PQS up to 6.x and classified as very critical. Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that requires this DLL. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.

The weakness was published 12/13/2022 as ssa-849072. The advisory is shared at cert-portal.siemens.com. This vulnerability is known as CVE-2022-43722 since 10/24/2022. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/08/2023). MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 7.0 eliminates this vulnerability.

Similar entries are available at VDB-215458 and VDB-215466.

Productinfo

Vendor

• Siemens

Name

• SICAM PAS
• SICAM PQS

Version

• 6.x

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion