Cyber Resilience

CVE-2022-43398

High

Published: 08 November 2022

Published
08 November 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0045 64.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-43398 is a high-severity Session Fixation (CWE-384) vulnerability in Siemens 7Kg9501-0Aa01-2Aa1 Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 36.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices…

more

do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

siemens
7kg9501-0aa01-2aa1 firmware
≤ 2.50
siemens
7kg9501-0aa31-2aa1 firmware
≤ 2.50

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-384

Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

addresses: CWE-384

Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.

addresses: CWE-384

Enforces proper session ID generation and binding, preventing fixation of a known session token.

References