CVE-2024-11075
SICK Incoming Goods Suite privilege escalation vulnerability
- State
- Published
- Severity
- 8.8 High
- Published
- Nov 19, 2024
- Updated
- Nov 19, 2024
- Reserved
- Nov 11, 2024
Description
A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | SICK AG |
Weaknesses
- CWE-250 Execution with Unnecessary Privileges
Affected Products
| Product | Versions |
|---|---|
SICK Incoming Goods SuiteSICK AG |
|
References
- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.pdfvendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.jsonvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.