CVE-2022-43724: Critical severity siemens sicam pas/pqs vulnerability
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xpcmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-43724?
CVE-2022-43724 is classified as a critical vulnerability due to its potential to allow unauthenticated remote code execution.
How do I fix CVE-2022-43724?
To mitigate CVE-2022-43724, upgrade SICAM PAS/PQS to version 7.0 or newer and disable the xp_cmdshell feature.
Which versions are affected by CVE-2022-43724?
CVE-2022-43724 affects all versions of SICAM PAS/PQS prior to version 7.0.
What are the risks associated with CVE-2022-43724?
The risks include exposure of sensitive database credentials and the ability for attackers to execute arbitrary OS commands.
Can CVE-2022-43724 be exploited remotely?
Yes, CVE-2022-43724 can be exploited by unauthenticated remote attackers due to the cleartext transmission of database credentials.