Firmware Integrity Vulnerability in SiPass Integrated Access Control Systems
CVE-2022-31807

5.9MEDIUM

Key Information:

Vendor

Siemens
Status
Building X - Security Manager Edge Controller (acc-ap)
Vendor
CVE Published:
23 May 2025

What is CVE-2022-31807?

A vulnerability exists in SiPass integrated access control systems, specifically in the AC5102 and ACC-AP devices, where the integrity checks for firmware updates are insufficient. This oversight may permit a local attacker to upload malicious firmware directly to the device. Additionally, it creates a potential risk where a remote attacker could intercept firmware updates during transmission, allowing them to modify legitimate firmware before installation. This flaw underscores the importance of robust firmware validation measures to prevent unauthorized access and ensure system integrity.

Affected Version(s)

Building X - Security Manager Edge Controller (ACC-AP) 0

References

https://cert-portal.siemens.com/productcert/html/ssa-3677...
https://cert-portal.siemens.com/productcert/html/ssa-4203...

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-31807 : Firmware Integrity Vulnerability in SiPass Integrated Access Control Systems