Vulnerability · Published Dec 6, 2024 · Assigned by SICK AG
CVE-2024-11022SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack
Medium 5.6
In plain English
A medium-severity security flaw in SICK InspectorP61x from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.4%top 64.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SICK AG | SICK InspectorP61x | all versions |
| SICK AG | SICK InspectorP62x | all versions |
Weakness: CWE-323 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://sick.com/psirt x_SICK PSIRT Website
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json vendor-advisory, x_csaf