exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication

Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication
Posted Apr 15, 2022
Authored by T. Weber, Gerhard Hechenberger, Steffen Robertz | Site sec-consult.com

Siemens A8000 CP-8050/CP-8031 SICAM WEB suffers from denial of service and a missing authentication vulnerability that allows for file download.

tags | exploit, web, denial of service
advisories | CVE-2021-45034, CVE-2022-27480
SHA-256 | 7f0a0ec0c017ac5bb71670246359ab27291e0f6543e3a3b66f3b4ecf9cd874dc

Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20220413-0 >
title: Missing Authentication at File Download & Denial of Service
product: Siemens A8000 CP-8050/CP-8031 SICAM WEB
vulnerable version: < SICAM WEB Version 05.80 / < Firmware Package 04.80
fixed version: SICAM WEB V05.80 / Firmware Package 04.80
CVE number: CVE-2022-27480
impact: Medium
homepage: https://www.siemens.com
found: 2021-11-10
by: SEC Consult Vulnerability Lab
This vulnerability was discovered during the research
cooperation initiative "OT Cyber Security Lab" between
Verbund AG and SEC Consult Group.
Steffen Robertz (Office Vienna)
Gerhard Hechenberger (Office Vienna)
Thomas Weber (Office Vienna)

An integrated part of SEC Consult, an Atos company
Europe | Asia | North America



Vendor description:
"We are a technology company focused on industry, infrastructure, transport,
and healthcare. From more resource-efficient factories, resilient
supply chains, and smarter buildings and grids, to cleaner and more comfortable
transportation as well as advanced healthcare, we create technology with
purpose adding real value for customers. By combining the real and the digital
worlds, we empower our customers to transform their industries and markets,
helping them to transform the everyday for billions of people."

Source: https://new.siemens.com/global/en/company/about.html

Business recommendation:
Update to the current firmware in order to fix the missing authentication vulnerability.
Siemens will not fix the denial of service vulnerability.

SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve
potential further security issues.

Vulnerability overview/description:
1) Missing Authentication at File Download (CVE-2022-27480)
Several files that can be created by an authorized user are placed in the
web server's root directory. The user can then download these files with a
press on a UI button. However, the files are not deleted automatically after
the user downloads them. The filenames are static and the download does not
require any authentication. Therefore, they can be retrieved by anybody later.

2) Denial of Service Condition
The PLC will stop responding to any connection attempts as soon as a light
network load is placed on it. This effectively shuts down the management

Proof of concept:
1) Missing Authentication at File Download (CVE-2022-27480)
First, a file has to be created. This is possible by logging into SICAM Web.
As an example, a network traffic capture can be created by navigating to
"Monitoring & Simulation" -> "Ethernet Packet Capture".

The following request shows how another client downloads the resulting
wireshark.zip file without sending any authentication headers.

GET /wireshark.zip HTTP/1.1
Host: [IP]

The server responds with the created capture file:
HTTP/1.1 200 OK
Content-Type: application/zip
Accept-Ranges: bytes
Cache-Control: max-age=0, private
Content-Length: 370
Server: A8000


2) Denial of Service Condition
Putting a light network load on the PLC's interfaces causes a denial of
service condition. In the tests it was enough to run a directory bruteforce
with 5 threads in order to shut down all management interfaces. After the
scan stopped, it took several minutes for the PLC to come back online.

Vulnerable / tested versions:
The following product has been tested:
* Siemens A8000 CP-8050 SICAM Web 05.50

Vendor contact timeline:
2022-02-07: Contacting vendor through productcert@siemens.com
2022-02-07: Siemens opened ticket, Issue 1 is already known for another product (CVE-2021-45034)
2022-02-09: Provided further information about the PLC version to Siemens
2022-02-10: Information forwarded to developers
2022-02-15: Siemens identified the right model, does not consider DoS as
valid finding, as it does not stop the control loop from running and it is
not an edge device
2022-03-22: Siemens asks to move disclosure date to their patch day on April 12th.
SEC Consult agrees. Siemens now recognizes the DoS condition, but is
accepting the risk and won't patch.
2022-03-28: Informing Siemens that our advisory will be coordinated with their patch
2022-04-12: Siemens patch day and Siemens advisory release.
2022-04-13: SEC Consult advisory release.

For issue 1: Update to the current firmware, for further information see the advisory from
the vendor:


For issue 2: Siemens marked this vulnerability as wont-fix.
The issue will/can not be patched by software. Siemens accepts the risk, as
the control loop keeps running and the device is not an edge device.

Restrict network access to the A8000 and make sure, that your use-case does
not send traffic exceeding the DoS limitation.

Advisory URL:


SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Steffen Robertz, Gerhard Hechenberger, Thomas Weber / @2022

Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By