ICS Advisory: Siemens SICAM A8000

Summary:

The CISA (Cybersecurity and Infrastructure Security Agency) has announced that it will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. The advisory provides information on a vulnerability in SICAM A8000 devices, specifically the CP-8031 MASTER MODULE and CP-8050 MASTER MODULE, which can be exploited by an authenticated remote attacker to inject commands with root privileges during device startup. The vulnerability has a CVSS v3 base score of 6.6 and is assigned the CVE-2023-42797 number. Siemens has recommended mitigations, including updating to a later version, reviewing user permissions, and applying strong passwords. CISA recommends minimizing network exposure, isolating devices, and using secure remote access methods.