Vulnerability · Published Dec 6, 2024 · Assigned by SICK AG
CVE-2024-10773SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks
Critical 9.0
In plain English
A critical-severity security flaw in SICK InspectorP61x from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.6%top 51.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | SICK InspectorP61x | 0 – before <5.0.0 |
| SICK AG | SICK InspectorP62x | 0 – before <5.0.0 |
| SICK AG | TiM3xx | 0 – before <5.10.0 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://sick.com/psirt x_SICK PSIRT Website
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json vendor-advisory, x_csaf