Web Interface Vulnerability in POWER METER SICAM Q200 by Siemens
CVE-2023-30901

8.8HIGH

Key Information:

Vendor
Siemens
Status
POWER METER SICAM Q100
Vendor
CVE Published:
13 June 2023

Summary

A vulnerability exists in the web interface of the POWER METER SICAM Q200 family that exposes it to Cross-Site Request Forgery (CSRF) attacks. An attacker can exploit this weakness by deceiving an authenticated user into clicking a malicious link, which allows the attacker to execute unauthorized commands on the targeted device while appearing to act on behalf of the user. It is crucial for users to apply the necessary updates to version V2.70 or later to mitigate this risk and safeguard their systems.

Affected Version(s)

POWER METER SICAM Q100 All versions < V2.60

POWER METER SICAM Q100 All versions < V2.60

References

https://cert-portal.siemens.com/productcert/pdf/ssa-88724...
https://cert-portal.siemens.com/productcert/pdf/ssa-48009...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.