Vulnerability · Published Jun 28, 2021 · Assigned by SICK AG

CVE-2021-32496

Medium 5.3

In plain English

A medium-severity security flaw in SICK Visionary-S CX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.

Affected products (as reported)

Vendor	Product	Versions
n/a	SICK Visionary-S CX	<5.21.2.29154R

References

https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories x_refsource_MISC