CVE-2022-27480 Missing authorization in SICAM A8000 CP-8031
Unauthenticated attackers can download sensitive files from Siemens SICAM A8000 devices due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27480?
CVE-2022-27480 is a high-severity missing authorization vulnerability in Siemens SICAM A8000 CP-8031, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files.
Which versions are affected by CVE-2022-27480?
It affects 2 products.
Products include Siemens Sicam A8000 Cp-8031 Firmware, Siemens Sicam A8000 Cp-8050 Firmware.
How do I fix CVE-2022-27480?
No fix has been published for CVE-2022-27480 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-27480 being exploited?
There is no known exploitation of CVE-2022-27480 in the wild and no public exploit code.
Other vulnerabilities in Siemens SICAM A8000 CP-8031
Sources
Also known as GHSA-fcp5-57p2-vf46.