Protection mechanism failure in Siemens SICAM A8000 CP-8000
Priority LOW 33CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-693 and CWE-327.
Summary
A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions < V16). A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position could decrypt the communication and compromise confidentiality and integrity of the transmitted information.
Why it matters now
EPSS 0.00571 47th percentileScored 2026-11-07
Fix Fixed SICAM A8000 CP-8000 (Siemens): V16SICAM A8000 CP-8021 (Siemens): V16+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SICAM A8000 CP-8000 | before V16 | V16 | Patch available | CNA |
| Siemens | SICAM A8000 CP-8021 | before V16 | V16 | Patch available | CNA |
| Siemens | SICAM A8000 CP-8022 | before V16 | V16 | Patch available | CNA |
- SICAM A8000 CP-8000 VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- SICAM A8000 CP-8021 VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- SICAM A8000 CP-8022 VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:sicam_a8000_cp-8000_firmware:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sicam_a8000_cp-8000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sicam_a8000_cp-8021_firmware:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sicam_a8000_cp-8021:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sicam_a8000_cp-8022_firmware:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sicam_a8000_cp-8022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:sicam_a8000_cp-8000_firmware:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sicam_a8000_cp-8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sicam_a8000_cp-8021_firmware:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sicam_a8000_cp-8021:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sicam_a8000_cp-8022_firmware:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sicam_a8000_cp-8022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SICAM A8000 CP-8000 (Siemens) Fixed in V16
- Fix · CNA SICAM A8000 CP-8021 (Siemens) Fixed in V16
- Fix · CNA SICAM A8000 CP-8022 (Siemens) Fixed in V16
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28396
- 2026-10-03 Alias added: GHSA-gw3g-78vp-6j8f
References
More Siemens Sicam A8000 Cp-8000 Firmware vulnerabilities
- TI-2018-10010 Improper input validation in Siemens SICAM A8000 CP-8000, SICAM A8000 CP-802X, SICAM… CVSS 3.0HIGH 7.5
- TI-2022-12239 A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All… CVSS 3.1HIGH 7.5
Sources
- CVE-2020-28396 · CVE Program
- CVE-2020-28396 · NVD
- FIRST EPSS
- GHSA-gw3g-78vp-6j8f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences