CVE-2021-44165 Memory corruption in POWER METER SICAM Q100
A buffer overflow in the web application allows remote attackers with engineer or admin privileges to execute arbitrary code on Siemens SICAM Q100 power meters.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-44165?
CVE-2021-44165 is a high-severity memory corruption vulnerability in Siemens POWER METER SICAM Q100, published on 14 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution.
Weakness: CWE-121
Which versions are affected by CVE-2021-44165?
It affects 4 products.
Products include Siemens 7kg9501-0aa01-0aa1 Firmware, Siemens 7kg9501-0aa01-2aa1 Firmware, Siemens 7kg9501-0aa31-0aa1 Firmware, Siemens 7kg9501-0aa31-2aa1 Firmware.
How do I fix CVE-2021-44165?
No fix has been published for CVE-2021-44165 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-44165 being exploited?
There is no known exploitation of CVE-2021-44165 in the wild and no public exploit code.
Sources
Also known as GHSA-rwp6-cpw3-hxxx.