Siemens SICAM Q100/Q200 SMTP password storage flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Siemens power meters store SMTP credentials in plaintext, allowing authenticated local attackers to extract passwords for mail service abuse.
Siemens SICAM Q100 and Q200 power meters contain two related cleartext-storage vulnerabilities affecting SMTP account credentials. Both CVE-2025-40752 and CVE-2025-40753 allow an authenticated local attacker to extract the SMTP password stored in plaintext either in device memory or in exported configuration files. An attacker with local access could then abuse the configured mail service for arbitrary purposes. The vulnerabilities require local access and authentication; they are not remotely exploitable. SICAM Q100 versions 2.60 through 2.61 and SICAM Q200 versions 2.70 through 2.79 are affected. Siemens has released patched versions (Q100 v2.62+, Q200 v2.80+). No active exploitation has been reported to CISA as of publication.
Mentioned in this report
Detection guidance
Search of Files for SMTP Password Strings on Windows
findstr or PowerShell Select-String used to hunt for SMTP password values in files, matching extraction of cleartext SMTP credentials from exported device configuration files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Search of Files for SMTP Password Strings on Windows
description: Detects findstr.exe or PowerShell Select-String commands that search
for SMTP and password strings together. This matches an attacker mining exported
device configuration files (for example power meter or ICS exports) for cleartext
SMTP credentials. Generalises on the tool and keyword pattern, not on specific file
names.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection_findstr:
Image|endswith: \findstr.exe
CommandLine|contains|all:
- smtp
- pass
selection_powershell:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- Select-String
- smtp
- pass
condition: 1 of selection_*
falsepositives:
- Administrators auditing mail relay settings in application configuration files
- Security teams running credential-exposure scans of configuration repositories
level: low
id: 6e46a5bc-7891-5640-ab5d-6e5854a0b160
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16
Search of Files for SMTP Password Strings on Linux
grep-family tools used to search for SMTP password values, matching extraction of cleartext SMTP credentials from exported configuration files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Search of Files for SMTP Password Strings on Linux
description: Detects grep-family commands that search for SMTP and password strings
together. This matches an attacker with local access mining exported configuration
files for cleartext SMTP credentials. Generalises on the tool and keyword pattern,
not on specific file names.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /grep
- /egrep
- /fgrep
- /rg
CommandLine|contains|all:
- smtp
- pass
condition: selection
falsepositives:
- Administrators troubleshooting mail relay configuration such as postfix or msmtp
settings
- Configuration audit scripts that scan for hard-coded secrets
level: low
id: 3fc7e951-6618-5896-88b5-552225ba7042
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs