Certificate Validation Vulnerabilities in SICAM TOOLBOX II Before V07.11

An attacker positioned on the network path between your workstation and a SICAM-managed device could intercept and decrypt HTTPS traffic, potentially capturing credentials or commands sent to the device, or injecting malicious commands into the communication stream.

Engineering and operations staff at utilities and industrial facilities who use SICAM TOOLBOX II to manage Siemens SICAM power management and automation devices. This affects anyone who administers or configures SICAM-controlled substations, distribution networks, or power plant equipment via HTTPS management interfaces.

An attacker with network access between the engineering workstation running SICAM TOOLBOX II and the managed Siemens device can perform a man-in-the-middle attack by presenting a forged TLS certificate. Because SICAM TOOLBOX II does not properly validate device certificates, it will accept the forged certificate and establish an encrypted tunnel with the attacker instead of the legitimate device, allowing interception and modification of all traffic.