CVE-2020-10042 Memory corruption in SICAM MMU

What is CVE-2020-10042?

CVE-2020-10042 is a critical memory corruption vulnerability in Siemens AG SICAM MMU, published on 14 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.

Weakness: CWE-120

Which versions are affected by CVE-2020-10042?

It affects 3 products.

Products include Siemens Sicam Mmu Firmware, Siemens Sicam Sgu Firmware, Siemens Sicam T Firmware.

How do I fix CVE-2020-10042?

No fix has been published for CVE-2020-10042 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-10042 being exploited?

There is no known exploitation of CVE-2020-10042 in the wild and no public exploit code.

Other vulnerabilities in Siemens AG SICAM MMU

• CVE-2020-10038 Auth bypass in SICAM MMU Critical 9.8
• CVE-2020-10045 Auth bypass in SICAM MMU High 8.8
• CVE-2020-10039 Other in SICAM MMU High 8.1
• CVE-2020-10037 Information disclosure in SICAM MMU High 7.5
• CVE-2020-10044 Missing authorization in SICAM MMU High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-53f6-5gcr-4fhc.