Siemens Sicam Pas/pqs vulnerabilities

12 CVEs affecting Siemens Sicam Pas/pqs, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-45205, published 2023-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-9157, published 2016-12-05. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by…
CVE-2016-8567, published 2017-02-13. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database…
CVE-2018-4858, published 2018-07-09. High severity, CVSS 7.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated) (All versions < V7.80), DIGSI 4 (All…
CVE-2016-9156, published 2016-12-05. High severity, CVSS 7.3. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted…
CVE-2022-43723, published 2022-12-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for a certain parameter…
CVE-2022-43724, published 2022-12-13. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by…
CVE-2016-8566, published 2017-02-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a Recoverable Format, an authenticated local attacker with certain privileges could possibly reconstruct the…
CVE-2016-5849, published 2016-07-04. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage.
CVE-2016-5848, published 2016-07-04. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leveraging unspecified database privileges.
CVE-2022-43722, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a…

Latest

CVE-2023-45205, published 2023-10-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow…
CVE-2023-38640, published 2023-10-10. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow…