{"id":"CVE-2022-43398","aliases":["EUVD-2022-46436","GHSA-fph2-95mp-m2fq"],"status":"published","title":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER...","description":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies.  An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00596,"percentile":0.48831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-384"],"published":"2022-11-08T00:00:00Z","modified":"2026-06-17T05:06:26Z","products":[{"vendor":"siemens","product":"7kg9501-0aa01-2aa1_firmware"},{"vendor":"siemens","product":"7kg9501-0aa31-2aa1_firmware"},{"vendor":"siemens","product":"power meter sicam q100"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf","tags":["x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43398"},{"url":"https://github.com/advisories/GHSA-fph2-95mp-m2fq"}],"sources":{"cve":[{"id":"CVE-2022-43398","description":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies.  An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2024-08-03T13:32:58.148Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:34:25.618175Z"}],"euvd":[{"id":"EUVD-2022-46436","description":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies.  An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2024-08-03T13:32:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-fph2-95mp-m2fq","title":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER...","description":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.","status":"published","published":"2022-11-08T12:00:17Z","modified":"2023-06-22T05:03:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:54:38.89081Z"}],"nvd":[{"id":"CVE-2022-43398","description":"A vulnerability has been identified in POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50), POWER METER SICAM Q100 (All versions \u003c V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies.  An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.","status":"published","published":"2022-11-08T11:15:11.94Z","modified":"2026-06-17T05:06:26.163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:07:31.504574Z"}]}}