CVE-2020-15781

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-14 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.

Affected products

Siemens AG SICAM WEB firmware for SICAM A8000 RTUs: before 05.30 — fixed in 05.30

How to fix

Upgrade to a fixed version: Siemens AG SICAM WEB firmware for SICAM A8000 RTUs 05.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15781 or the next vulnerability affects your stack