CVE-2022-29873: siemens 7kg8500-0aa00-0aa0_firmware

Vulnerability summary

CVE-2022-29873 is a critical (CVSS 9.8) vulnerability in siemens 7kg8500-0aa00-0aa0_firmware. EPSS estimates a 1.99% chance of exploitation in the next 30 days, higher than 80.3% of scored vulnerabilities.

Timeline

1. 10-05-2022
   PublishedVulnerability first disclosed.
2. 09-12-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.

• CWE-141Improper Neutralization of Parameter/Argument DelimitersThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.