SEC Consult Vulnerability Lab Security Advisory < 20220413-0 >  
title: Missing Authentication at File Download & Denial of Service  
product: Siemens A8000 CP-8050/CP-8031 SICAM WEB  
vulnerable version: < SICAM WEB Version 05.80 / < Firmware Package 04.80  
fixed version: SICAM WEB V05.80 / Firmware Package 04.80  
CVE number: CVE-2022-27480  
impact: Medium  
found: 2021-11-10  
by: SEC Consult Vulnerability Lab  
This vulnerability was discovered during the research  
cooperation initiative "OT Cyber Security Lab" between  
Verbund AG and SEC Consult Group.  
Steffen Robertz (Office Vienna)  
Gerhard Hechenberger (Office Vienna)  
Thomas Weber (Office Vienna)  
An integrated part of SEC Consult, an Atos company  
Europe | Asia | North America  
Vendor description:  
"We are a technology company focused on industry, infrastructure, transport,  
and healthcare. From more resource-efficient factories, resilient  
supply chains, and smarter buildings and grids, to cleaner and more comfortable  
transportation as well as advanced healthcare, we create technology with  
purpose adding real value for customers. By combining the real and the digital  
worlds, we empower our customers to transform their industries and markets,  
helping them to transform the everyday for billions of people."  
Business recommendation:  
Update to the current firmware in order to fix the missing authentication vulnerability.  
Siemens will not fix the denial of service vulnerability.  
SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve  
potential further security issues.  
Vulnerability overview/description:  
1) Missing Authentication at File Download (CVE-2022-27480)  
Several files that can be created by an authorized user are placed in the  
web server's root directory. The user can then download these files with a  
press on a UI button. However, the files are not deleted automatically after  
the user downloads them. The filenames are static and the download does not  
require any authentication. Therefore, they can be retrieved by anybody later.  
2) Denial of Service Condition  
The PLC will stop responding to any connection attempts as soon as a light  
network load is placed on it. This effectively shuts down the management  
Proof of concept:  
1) Missing Authentication at File Download (CVE-2022-27480)  
First, a file has to be created. This is possible by logging into SICAM Web.  
As an example, a network traffic capture can be created by navigating to  
"Monitoring & Simulation" -> "Ethernet Packet Capture".  
The following request shows how another client downloads the resulting file without sending any authentication headers.  
GET / HTTP/1.1  
Host: [IP]  
The server responds with the created capture file:  
HTTP/1.1 200 OK  
Content-Type: application/zip  
Accept-Ranges: bytes  
Cache-Control: max-age=0, private  
Content-Length: 370  
Server: A8000  
2) Denial of Service Condition  
Putting a light network load on the PLC's interfaces causes a denial of  
service condition. In the tests it was enough to run a directory bruteforce  
with 5 threads in order to shut down all management interfaces. After the  
scan stopped, it took several minutes for the PLC to come back online.  
Vulnerable / tested versions:  
The following product has been tested:  
* Siemens A8000 CP-8050 SICAM Web 05.50  
Vendor contact timeline:  
2022-02-07: Contacting vendor through  
2022-02-07: Siemens opened ticket, Issue 1 is already known for another product (CVE-2021-45034)  
2022-02-09: Provided further information about the PLC version to Siemens  
2022-02-10: Information forwarded to developers  
2022-02-15: Siemens identified the right model, does not consider DoS as  
valid finding, as it does not stop the control loop from running and it is  
not an edge device  
2022-03-22: Siemens asks to move disclosure date to their patch day on April 12th.  
SEC Consult agrees. Siemens now recognizes the DoS condition, but is  
accepting the risk and won't patch.  
2022-03-28: Informing Siemens that our advisory will be coordinated with their patch  
2022-04-12: Siemens patch day and Siemens advisory release.  
2022-04-13: SEC Consult advisory release.  
For issue 1: Update to the current firmware, for further information see the advisory from  
the vendor:  
For issue 2: Siemens marked this vulnerability as wont-fix.  
The issue will/can not be patched by software. Siemens accepts the risk, as  
the control loop keeps running and the device is not an edge device.  
Restrict network access to the A8000 and make sure, that your use-case does  
not send traffic exceeding the DoS limitation.  
Advisory URL:  
SEC Consult Vulnerability Lab  
SEC Consult, an Atos company  
Europe | Asia | North America  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Atos company. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
Interested to work with the experts of SEC Consult?  
Send us your application  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices  
Mail: research at sec-consult dot com  
EOF Steffen Robertz, Gerhard Hechenberger, Thomas Weber / @2022