Siemens SICAM Q100 and Q200 Power Meters Information Disclosure Vulnerability

A vulnerability exists in certain POWER METER SICAM Q100 and Q200 devices, specifically in versions of the Q100 family prior to 2.62 and in the Q200 family versions 2.70 through 2.80. The vulnerability arises because affected devices export the SMTP account password as plain text in the configuration file. This flaw could enable an authenticated local attacker to extract the password and misuse the SMTP service for various purposes.

Impact

Exploitation of this vulnerability could lead to unauthorized use of the SMTP service, potentially allowing for the sending of emails that could be misused for phishing or other malicious activities.

Remediation

Siemens has released new versions for the affected products. For the SICAM Q100 family, users should update to the latest version. For the SICAM Q200 family, users should update to version 2.80 or later. Recommended security guidelines can be found on the Siemens Grid Security website.