Multiple Vulnerabilities in SICAM A8000

An attacker with engineering credentials could enable a debug port using hardcoded credentials to gain remote access to the device. Additionally, an unauthenticated attacker could access historical log files containing sensitive operational data from SICAM A8000 devices.

Operators of Siemens SICAM A8000 substation automation systems (particularly those using CP-8000, CP-8021, or CP-8022 master modules) need to address these vulnerabilities. These devices are critical in electric utility SCADA and protection relay systems where they manage communication between substations and control centers.

An attacker with valid engineering workstation credentials could remotely connect to the SICAM A8000, enable the debug port with default hardcoded credentials, and then use those credentials to execute commands on the device. Separately, an unauthenticated attacker could access the device over the network and retrieve previously created log files that may contain sensitive information about device configuration or operation.