Vulnerability · Published Oct 17, 2024 · Assigned by SICK AG
CVE-2024-10025Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx
Critical 9.1
In plain English
A critical-severity hard-coded credentials in SICK CLV6xx from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | SICK CLV6xx | all versions |
| SICK AG | SICK Lector6xx | all versions |
| SICK AG | SICK RFx6xx | all versions |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://sick.com/psirt x_SICK PSIRT Webseite
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json vendor-advisory, x_csaf