Insufficiently protected credentials in Siemens SICAM GridEdge
Priority LOW 31CWE-402Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon request. This could allow an authenticated user to retrieve another user's password hash.
Why it matters now
EPSS 0.0063 50th percentileScored 2026-11-07
Fix Fixed SICAM GridEdge (Classic) (Siemens): V2.6.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SICAM GridEdge (Classic) | before V2.6.6 | V2.6.6 | Patch available | CNA |
- SICAM GridEdge (Classic) VendorSiemens Affected before V2.6.6 Fixed in V2.6.6 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:arm:*:*:* | before 2.6.6 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_arm:*:*:* | before 2.6.6 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_intel:*:*:* | before 2.6.6 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:intel:*:*:* | before 2.6.6 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:arm:*:*:* Versions before 2.6.6 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_arm:*:*:* Versions before 2.6.6 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_intel:*:*:* Versions before 2.6.6 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:intel:*:*:* Versions before 2.6.6 Vulnerable ·Siemens
Remediation
- Fix · CNA SICAM GridEdge (Classic) (Siemens) Fixed in V2.6.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Siemens SICAM GridEdge (Classic) V2.6.6
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-12486 Missing authentication in Siemens SICAM GridEdgePriority MEDIUM 42
- TI-2022-12485 Missing authentication in Siemens SICAM GridEdgePriority LOW 39
- TI-2022-12484 Origin validation error in Siemens SICAM GridEdgePriority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30231
- 2026-10-03 Alias added: GHSA-9rc7-jmvv-4fhr
- 2026-11-03 EPSS moved to the 50th–90th percentile
References
More Siemens Sicam Gridedge Essential vulnerabilities
- TI-2022-12486 Missing authentication in Siemens SICAM GridEdge CVSS 4.0CRITICAL 9.3
- TI-2022-12485 Missing authentication in Siemens SICAM GridEdge CVSS 4.0HIGH 8.6
- TI-2022-12484 Origin validation error in Siemens SICAM GridEdge CVSS 4.0HIGH 8.6
Sources
- CVE-2022-30231 · CVE Program
- CVE-2022-30231 · NVD
- FIRST EPSS
- GHSA-9rc7-jmvv-4fhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences