{"id":"CVE-2022-29876","aliases":["EUVD-2022-34188","GHSA-m67p-4364-8xgh"],"status":"published","title":"A vulnerability has been identified in SICAM P850 (All versions \u003c V3.00), SICAM P850 (All...","description":"A vulnerability has been identified in SICAM T (All versions \u003c V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00861,"percentile":0.5884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-05-10T09:47:19Z","modified":"2026-06-17T04:40:52Z","products":[{"vendor":"siemens","product":"7kg8500-0aa00-0aa0_firmware"},{"vendor":"siemens","product":"7kg8500-0aa00-2aa0_firmware"},{"vendor":"siemens","product":"7kg8500-0aa10-0aa0_firmware"},{"vendor":"siemens","product":"7kg8500-0aa10-2aa0_firmware"},{"vendor":"siemens","product":"7kg8500-0aa30-0aa0_firmware"},{"vendor":"siemens","product":"7kg8500-0aa30-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa01-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa01-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa02-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa02-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa11-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa11-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa12-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa12-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa31-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa31-2aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa32-0aa0_firmware"},{"vendor":"siemens","product":"7kg8501-0aa32-2aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa00-0aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa00-2aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa10-0aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa10-2aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa30-0aa0_firmware"},{"vendor":"siemens","product":"7kg8550-0aa30-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa01-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa01-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa02-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa02-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa11-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa11-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa12-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa12-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa31-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa31-2aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa32-0aa0_firmware"},{"vendor":"siemens","product":"7kg8551-0aa32-2aa0_firmware"},{"vendor":"siemens","product":"sicam t"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-165073.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-471761.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29876"},{"url":"https://github.com/advisories/GHSA-m67p-4364-8xgh"}],"sources":{"cve":[{"id":"CVE-2022-29876","description":"A vulnerability has been identified in SICAM T (All versions \u003c V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.","status":"published","published":"2022-05-10T09:47:19Z","modified":"2025-12-09T10:36:29.341Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-34188","description":"A vulnerability has been identified in SICAM T (All versions \u003c V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.","status":"published","published":"2022-05-10T09:47:19Z","modified":"2025-12-09T10:36:29Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:08.541096Z"}],"ghsa":[{"id":"GHSA-m67p-4364-8xgh","title":"A vulnerability has been identified in SICAM P850 (All versions \u003c V3.00), SICAM P850 (All...","description":"A vulnerability has been identified in SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.","status":"published","published":"2022-05-21T00:01:05Z","modified":"2025-12-09T18:30:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:05:05.976411Z"}],"nvd":[{"id":"CVE-2022-29876","description":"A vulnerability has been identified in SICAM T (All versions \u003c V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.","status":"published","published":"2022-05-20T13:15:16.083Z","modified":"2026-06-17T04:40:52.78Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:20.264424Z"}]}}