CVE-2023-31238 identifies a vulnerability in Siemens SICAM P850 and related products (including SICAM P855 and SICAM T) in all versions prior to 3.11. The root cause is an incorrect permission assignment for critical resources, specifically the absence of cookie protection flags under default settings. Cookies lacking flags such as Secure, HttpOnly, or SameSite can be intercepted or manipulated by attackers who gain access to session tokens. This vulnerability falls under CWE-732 (Incorrect Permission Assignment for Critical Resource). An attacker with network access and low privileges, requiring user interaction, can leverage a stolen session token to impersonate legitimate users, potentially gaining unauthorized access to the device’s management interface or control functions. The CVSS v3.1 score is 5.5 (medium), reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed. The vulnerability affects confidentiality, integrity, and availability but with limited impact scope. No public exploits are known, but the risk is significant given the critical nature of SICAM devices in industrial control systems, especially in energy distribution and automation. Siemens has reserved the CVE and published details but no patch links are currently provided, indicating the need for vigilance and prompt updates once available.

European organizations operating Siemens SICAM P850 and related products in critical infrastructure sectors such as energy, utilities, and industrial automation face risks of unauthorized access and session hijacking. Successful exploitation could allow attackers to impersonate legitimate users, potentially leading to unauthorized control commands, data manipulation, or disruption of industrial processes. This could result in operational downtime, safety hazards, and regulatory non-compliance. Given the widespread deployment of Siemens industrial control systems in Europe, the impact could extend to national critical infrastructure, affecting grid stability and service continuity. Confidentiality breaches could expose sensitive operational data, while integrity and availability impacts could disrupt essential services. The medium severity score reflects moderate ease of exploitation but significant consequences if exploited.

1. Upgrade all affected Siemens SICAM P850, P855, and SICAM T devices to version 3.11 or later as soon as the patch becomes available from Siemens. 2. Until patches are applied, implement strict network segmentation to isolate SICAM devices from general IT networks and limit access to trusted administrators only. 3. Enforce multi-factor authentication (MFA) for all management interfaces to reduce the risk of session token misuse. 4. Monitor network traffic for unusual session token usage or repeated authentication failures that could indicate exploitation attempts. 5. Configure web application firewalls (WAFs) or intrusion detection systems (IDS) to detect and block suspicious cookie manipulation or session hijacking attempts. 6. Educate users and administrators about phishing and social engineering risks that could facilitate session token theft. 7. Regularly audit and review access permissions and session management policies on SICAM devices to ensure adherence to security best practices.