CVE-2024-10025
Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx
- State
- Published
- Severity
- 9.1 Critical
- Published
- Oct 17, 2024
- Updated
- Oct 17, 2024
- Reserved
- Oct 16, 2024
Description
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | SICK AG |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
SICK CLV6xxSICK AG |
|
SICK Lector6xxSICK AG |
|
SICK RFx6xxSICK AG |
|
References
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdfvendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.jsonvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.