CVE-2020-15781
Critical
Description
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.
SeverityCritical
CVSS9.6
Exploit probability—
ProductSiemens Sicam A8000 Firmware
PublishedAug 14, 2020
First seenAug 14, 2020
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- siemens sicam_a8000_firmware05.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens sicam_a8000_firmware | v < 05.30 | 05.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.