Improper input validation in Siemens SiPass integrated AC5102
Priority LOW 35CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed SiPass integrated AC5102 (ACC-G2) (Siemens): V2.85.44SiPass integrated ACC-AP (Siemens): V2.85.43
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SiPass integrated AC5102 (ACC-G2) | before V2.85.44 | V2.85.44 | Patch available | CNA |
| Siemens | SiPass integrated ACC-AP | before V2.85.43 | V2.85.43 | Patch available | CNA |
- SiPass integrated AC5102 (ACC-G2) VendorSiemens Affected before V2.85.44 Fixed in V2.85.44 Patch available CNA
- SiPass integrated ACC-AP VendorSiemens Affected before V2.85.43 Fixed in V2.85.43 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:* | before 2.85.43 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:* | before 2.85.44 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:* Versions before 2.85.43 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:* Versions before 2.85.44 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SiPass integrated AC5102 (ACC-G2) (Siemens) Fixed in V2.85.44
- Fix · CNA SiPass integrated ACC-AP (Siemens) Fixed in V2.85.43
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31808
- 2026-10-03 Alias added: GHSA-63hw-pp24-qp9g
References
More Siemens Sipass Integrated Ac5102 (acc-g2) Firmware vulnerabilities
- TI-2025-20329 Improper input validation in Siemens SiPass integrated AC5102 CVSS 4.0CRITICAL 9.4
- TI-2025-20328 Improper input validation in Siemens SiPass integrated AC5102 CVSS 4.0CRITICAL 9.3
- TI-2022-13699 Improper signature verification in Siemens Building X - Security Manager Edge Controller CVSS 4.0MEDIUM 5.9
Sources
- CVE-2022-31808 · CVE Program
- CVE-2022-31808 · NVD
- FIRST EPSS
- GHSA-63hw-pp24-qp9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences