TI-2020-12416 Aliases CVE-2020-15781 GHSA-rx5g-mw23-2hw2

Cross-site scripting in Siemens SICAM WEB firmware for SICAM A8000 RTUs

MEDIUM 43CWE-79Published 2020-08-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.

Why it matters now

EPSS 0.01002 63rd percentileScored 2026-11-07

Fix Fixed SICAM WEB firmware for SICAM A8000 RTUs (Siemens AG): V05.30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SICAM WEB firmware for SICAM A8000 RTUs	before V05.30	V05.30	Patch available	CNA

SICAM WEB firmware for SICAM A8000 RTUs VendorSiemens Affected before V05.30 Fixed in V05.30 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:siemens:sicam_a8000_firmware::::::::	before 05.30	Vulnerable	Siemens
cpe:2.3:h:siemens:sicam_a8000:-:::::::*	not specified by NVD	Running on	Siemens

cpe:2.3:o:siemens:sicam_a8000_firmware:*:*:*:*:*:*:*:* Versions before 05.30 Vulnerable ·Siemens
cpe:2.3:h:siemens:sicam_a8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

Fix · CNA SICAM WEB firmware for SICAM A8000 RTUs (Siemens AG) Fixed in V05.30

Timeline

2026-10-02 Threatist record created from CVE-2020-15781
2026-10-03 Alias added: GHSA-rx5g-mw23-2hw2

References

Patch 1

https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf

TI-2024-22516 Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a… CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences