Vulnerability · Published Mar 14, 2025 · Assigned by SICK AG
CVE-2025-27593RCE due to Device Driver
Critical 9.3
In plain English
A critical-severity security flaw in SICK DL100-2xxxxxxx from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 64.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | SICK DL100-2xxxxxxx | all versions |
Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://sick.com/psirt x_SICK PSIRT Website
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.json vendor-advisory, x_csaf
- https://github.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html third-party-advisory