Vulnerability · Published Dec 6, 2024 · Assigned by SICK AG
CVE-2024-10771SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution
High 8.8
In plain English
A high-severity code injection in SICK InspectorP61x from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | SICK InspectorP61x | 0 – before <5.0.0 |
| SICK AG | SICK InspectorP62x | 0 – before <5.0.0 |
| SICK AG | TiM3xx | 0 – before <5.10.0 |
| SICK AG | TDC-X401GL | all versions |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://sick.com/psirt x_SICK PSIRT Website
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json vendor-advisory, x_csaf