Cyber Resilience

CVE-2022-27480

HighPublic PoC

Published: 12 April 2022

Published
12 April 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0036 58.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-27480 is a high-severity Missing Authorization (CWE-862) vulnerability in Siemens Sicam A8000 Cp-8031 Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 41.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to…

more

download these files.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

siemens
sicam a8000 cp-8031 firmware
≤ 4.80
siemens
sicam a8000 cp-8050 firmware
≤ 4.80

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862 CWE-425

Requiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.

addresses: CWE-862 CWE-425

Always invoking the reference monitor prevents missing authorization checks for protected resources.

addresses: CWE-862 CWE-425

Requiring enforcement of authorizations ensures checks are performed rather than omitted for resources.

addresses: CWE-425 CWE-862

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

addresses: CWE-862 CWE-425

Prevents missing authorization checks for input operations by restricting the capability itself.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

References