CVEvulnerability

CVE-2022-43724

9.8 CRITICAL Published 2022-12-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-319

Description

A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xp_cmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.

Affected configurations

• siemens sicam pas\/pqs (< 7.0)

Related

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References