Siemens SICAM MMU, SICAM T, and SICAM SGU
By performing a flooding attack against the web server, an attacker might be able to gain read access to the device's memory, possibly revealing confidential information. An attacker with access to the device's web server might be able to execute administrative commands without authentication. An attacker in a privileged network position between a legitimate user and the web server might be able to conduct a Man-in-the-middle attack and gain read and write access to the transmitted data. An attacker with local access to the device might be able to retrieve some passwords in clear text. A stored Cross-Site-Scripting (XSS) vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user. A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network. The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. An attacker with access to the network could be able to install specially crafted firmware to the device. An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application.