CVE-2022-43724criticalCWE-319

CVE-2022-43724: critical vulnerability in Siemens SICAM PAS/PQS

Published · Updated

Follow this CVE+ Monitor SICAM PAS/PQS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.7%
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xp_cmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Siemens · SICAM PAS/PQS
Related CVEs — Siemens SICAM PAS/PQS

In the same product, most dangerous first.

CVE-2022-43723HIGHCVE-2022-43723EPSS 1.0%CVE-2022-43722HIGHCVE-2022-43722EPSS 0.2%CVE-2023-45205HIGHCVE-2023-45205EPSS 0.2%CVE-2023-38640MEDIUMCVE-2023-38640EPSS 0.2%