Multiple Vulnerabilities in the Webinterface of SICAM P850 and SICAM P855 Devices

An attacker could access the device's web interface without authentication to view or modify substation automation settings, read unencrypted communications containing credentials or operational data, or manipulate the web interface to trick operators into executing unauthorized commands.

Substation automation engineers and operators managing Siemens SICAM P850 and P855 power monitoring and protection devices. Organizations operating electric substations, power distribution networks, and critical infrastructure facilities that rely on these devices for process control and monitoring should prioritize patching.

An attacker with network access to the SICAM P850 or P855 device's web interface port could directly access protected functionality without credentials. By exploiting missing HTTPS, the attacker could intercept unencrypted traffic containing sensitive data. Cross-site scripting vulnerabilities could be used to inject malicious code that runs in an operator's browser session.