CVE-2022-43546: Input Validation

Published Nov 8, 2022

Updated

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the EndTime-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.

Other sources

A vulnerability has been identified in POWER METER SICAM Q200 family (All versions < V2.70), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the EndTime-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.

Affected Software

8 affected components

All of the following

Siemens 7kg9501-0aa01-2aa1 Firmware<2.50

Siemens 7kg9501-0aa01-2aa1

All of the following

Siemens 7kg9501-0aa31-2aa1 Firmware<2.50

Siemens 7kg9501-0aa31-2aa1

Siemens 7kg9501-0aa01-2aa1 Firmware<2.50

Siemens 7kg9501-0aa01-2aa1

Siemens 7kg9501-0aa31-2aa1 Firmware<2.50

Siemens 7kg9501-0aa31-2aa1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade POWER METER SICAM Q100 to a version that resolves this vulnerability.
Fixed in V2.50
Upgrade
Upgrade POWER METER SICAM Q200 family to a version that resolves this vulnerability.
Fixed in V2.70
Upgrade
Upgrade SICAM P850 to a version that resolves this vulnerability.
Fixed in V3.10
Upgrade
Upgrade SICAM P855 to a version that resolves this vulnerability.
Fixed in V3.10
Compensating control
Restrict access to the device web interface on port 443/tcp so only necessary authenticated users can reach it (mitigation while upgrading to versions >= V2.50/V2.70/V3.10).

Event History

Nov 8, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-43546?

CVE-2022-43546 has a medium severity rating as it can lead to potential unauthorized access to sensitive data.

How do I fix CVE-2022-43546?

To fix CVE-2022-43546, upgrade the affected Siemens firmware to versions 2.50 or higher.

What products are affected by CVE-2022-43546?

CVE-2022-43546 affects the POWER METER SICAM Q100 (all versions below 2.50) and the SICAM P850 (all versions below 3.10).

When was CVE-2022-43546 disclosed?

CVE-2022-43546 was disclosed in late 2022.

Is there a workaround for CVE-2022-43546?

Currently, there is no official workaround for CVE-2022-43546 other than upgrading the affected firmware.