# Siemens SICAM Q100/Q200 SMTP password storage flaw

Published: 2025-08-14 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/309561cf-23dd-539e-b0f3-3e23a7713889/siemens-sicam-q100-q200-smtp-password-storage-flaw

> Siemens power meters store SMTP credentials in plaintext, allowing authenticated local attackers to extract passwords for mail service abuse.

Siemens SICAM Q100 and Q200 power meters contain two related cleartext-storage vulnerabilities affecting SMTP account credentials. Both CVE-2025-40752 and CVE-2025-40753 allow an authenticated local attacker to extract the SMTP password stored in plaintext either in device memory or in exported configuration files. An attacker with local access could then abuse the configured mail service for arbitrary purposes. The vulnerabilities require local access and authentication; they are not remotely exploitable. SICAM Q100 versions 2.60 through 2.61 and SICAM Q200 versions 2.70 through 2.79 are affected. Siemens has released patched versions (Q100 v2.62+, Q200 v2.80+). No active exploitation has been reported to CISA as of publication.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40752, CVE-2025-40753

## Detection guidance (public sample)

### Search of Files for SMTP Password Strings on Windows

ATT&CK: T1552.001

findstr or PowerShell Select-String used to hunt for SMTP password values in files, matching extraction of cleartext SMTP credentials from exported device configuration files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Search of Files for SMTP Password Strings on Windows
description: Detects findstr.exe or PowerShell Select-String commands that search
  for SMTP and password strings together. This matches an attacker mining exported
  device configuration files (for example power meter or ICS exports) for cleartext
  SMTP credentials. Generalises on the tool and keyword pattern, not on specific file
  names.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_findstr:
    Image|endswith: \findstr.exe
    CommandLine|contains|all:
    - smtp
    - pass
  selection_powershell:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - Select-String
    - smtp
    - pass
  condition: 1 of selection_*
falsepositives:
- Administrators auditing mail relay settings in application configuration files
- Security teams running credential-exposure scans of configuration repositories
level: low
id: 6e46a5bc-7891-5640-ab5d-6e5854a0b160
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16
```

### Search of Files for SMTP Password Strings on Linux

ATT&CK: T1552.001

grep-family tools used to search for SMTP password values, matching extraction of cleartext SMTP credentials from exported configuration files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Search of Files for SMTP Password Strings on Linux
description: Detects grep-family commands that search for SMTP and password strings
  together. This matches an attacker with local access mining exported configuration
  files for cleartext SMTP credentials. Generalises on the tool and keyword pattern,
  not on specific file names.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /grep
    - /egrep
    - /fgrep
    - /rg
    CommandLine|contains|all:
    - smtp
    - pass
  condition: selection
falsepositives:
- Administrators troubleshooting mail relay configuration such as postfix or msmtp
  settings
- Configuration audit scripts that scan for hard-coded secrets
level: low
id: 3fc7e951-6618-5896-88b5-552225ba7042
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/309561cf-23dd-539e-b0f3-3e23a7713889/siemens-sicam-q100-q200-smtp-password-storage-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup