CVE-2016-9156 Path traversal in Siemens SICAM PAS through V8.08

What is CVE-2016-9156?

CVE-2016-9156 is a high-severity path traversal vulnerability in Siemens SICAM PAS through V8.08, published on 5 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP.

Weakness: CWE-284, CWE-20

Which versions are affected by CVE-2016-9156?

It affects 1 product.

Products include Siemens Sicam Pas\/Pqs.

How do I fix CVE-2016-9156?

No fix has been published for CVE-2016-9156 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-9156 being exploited?

There is no known exploitation of CVE-2016-9156 in the wild and no public exploit code.

Other vulnerabilities in Siemens SICAM PAS through V8.08

• CVE-2022-43724 Hardcoded credentials in SICAM PAS/PQS Critical 9.8
• CVE-2016-8567 Hardcoded credentials in Siemens SICAM PAS before 8.00 Critical 9.8
• CVE-2016-9157 Denial of service in Siemens SICAM PAS through V8.08 Critical 9.8
• CVE-2023-45205 Privilege escalation in SICAM PAS/PQS High 7.8
• CVE-2022-43722 Code injection in SICAM PAS/PQS High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3v7r-r3pj-33fx.