Information Disclosure Vulnerabilities in SICAM Q100/Q200
Monitor6.2SSA-529291Aug 12, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
SICAM Q100 and Q200 power meters contain information disclosure vulnerabilities that allow an authenticated local attacker to extract the SMTP account password stored on the device. An attacker with local access can read the plaintext or weakly protected SMTP credentials and repurpose the configured email account for unauthorized communications. This affects devices running SICAM Q100 firmware 2.60 through 2.61 and SICAM Q200 firmware 2.70 through 2.79.
What this means
What could happen
An attacker with local access to a SICAM Q100 or Q200 power meter could extract the stored SMTP password and use it to send unauthorized emails or inject malicious content through your email system.
Who's at risk
Energy sector operators running SICAM Q100 (versions 2.60–2.61) or SICAM Q200 (versions 2.70–2.79) power meters should prioritize firmware updates. Anyone managing remote metering, billing systems, or power quality monitoring on these devices is affected.
How it could be exploited
An attacker with local access to the device can exploit the improper credential storage to read the SMTP account password from device memory or configuration. They can then use this password to access the configured email account for sending spam, phishing, or other fraudulent messages outside normal plant operations.
Prerequisites
- Local access to the SICAM Q100 or Q200 device
- Affected firmware version (Q100: 2.60–2.61; Q200: 2.70–2.79)
- No special privileges or credentials required to extract the password
requires local access (lower risk than remote)no authentication bypass needed once local access achievedaffects billing and monitoring infrastructurecredential exposure could enable lateral movement via email
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
POWER METER SICAM Q100≥ 2.60, < 2.622.62
POWER METER SICAM Q200 family≥ 2.70, < 2.802.80
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict physical access to SICAM Q100 and Q200 devices to authorized personnel only
HARDENINGChange SMTP account passwords immediately after updating firmware
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate SICAM Q100 firmware to version 2.62 or later
HOTFIXUpdate SICAM Q200 firmware to version 2.80 or later
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/860cd749-46cc-4ab8-9937-aef314ff2ab0