CVE-2022-43545 in POWER METER SICAM Q100
Summary
by MITRE • 11/08/2022
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not properly validate the RecordType-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/11/2025
The vulnerability CVE-2022-43545 affects the POWER METER SICAM Q100 industrial device, specifically all versions prior to V2.50, representing a critical security flaw in the device's web interface implementation. This issue resides within the authentication and input validation mechanisms of the device's HTTP service running on the standard secure port 443/tcp. The flaw manifests as improper validation of the RecordType-parameter, which serves as a critical control mechanism within the device's web application interface. The vulnerability is particularly concerning because it affects industrial control systems that are typically deployed in critical infrastructure environments where device reliability and security are paramount. The affected device operates within the energy metering and monitoring domain, making it a potential target for adversaries seeking to disrupt industrial operations or gain unauthorized access to critical infrastructure assets.
The technical implementation of this vulnerability stems from inadequate parameter validation within the web interface's request processing logic. When an authenticated attacker submits a crafted request containing a malformed RecordType-parameter, the device fails to properly sanitize or validate this input before processing it. This lack of input validation creates a path for exploitation that can lead to two distinct but serious consequences. The first impact involves a denial of service condition where the device becomes unresponsive and automatically reboots, potentially disrupting critical power monitoring operations. The second and more severe impact allows for arbitrary code execution on the device, providing attackers with complete control over the system's operations. This vulnerability directly maps to CWE-20, which describes improper input validation, and represents a classic example of how insufficient parameter validation can lead to both service disruption and privilege escalation scenarios. The vulnerability is particularly dangerous because it requires only authentication, meaning that an attacker who has obtained valid credentials can exploit this weakness without requiring additional attack vectors.
The operational impact of CVE-2022-43545 extends beyond simple device disruption to encompass potential compromise of entire industrial control networks. In critical infrastructure environments where the POWER METER SICAM Q100 devices are deployed, a successful exploitation could result in loss of power monitoring data, disruption of grid management operations, or even provide a foothold for broader network infiltration. The automatic reboot capability means that an attacker could repeatedly exploit the vulnerability to cause persistent service disruption, potentially masking other malicious activities or creating conditions for more sophisticated attacks. The ability to execute arbitrary code represents a complete compromise of the device's security posture, allowing attackers to modify device configurations, install backdoors, or use the compromised device as a pivot point for attacking other systems within the industrial network. This vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter, and T1498 for network denial of service, demonstrating how this single vulnerability can enable multiple attack vectors. The impact is particularly severe in environments where these devices are part of larger SCADA or ICS systems, as they may serve as critical monitoring points for power distribution networks.
Organizations should implement immediate mitigation strategies including prompt deployment of firmware updates to version V2.50 or later, which addresses the input validation flaw. Network segmentation and access controls should be strengthened to limit exposure of these devices to unauthorized users, while implementing strict authentication requirements and monitoring for unusual access patterns. Security teams should conduct comprehensive vulnerability assessments of all similar industrial devices within their networks to identify potential equivalents of this vulnerability. The device should be configured with minimal necessary access rights, and all administrative interfaces should be protected with strong authentication mechanisms. Additionally, implementing network monitoring solutions that can detect anomalous traffic patterns related to web interface requests may help identify exploitation attempts. Organizations should also consider implementing intrusion detection systems specifically designed for industrial control systems to provide additional layers of protection against such vulnerabilities. Regular security audits and vulnerability management processes should be enhanced to ensure timely patch deployment and reduce the window of exposure for similar vulnerabilities in industrial control equipment. The vulnerability demonstrates the critical importance of maintaining up-to-date firmware in industrial environments and the need for robust security practices in critical infrastructure protection.