Summary
SICK received a report about multiple security vulnerabilities in the Package Analytics software. Successful exploitation of these vulnerabilities could allow an unauthorized remote attacker to read and write the configuration of the software, read data directly from the file system and view passwords
in plain text.
Currently SICK is not aware of any public exploits specifically targeting any of the vulnerabilities.
SICK has released a new version of the SICK Package Analytics software and recommends updating to the newest version.
Vulnerabilities 3
-
Unscored —
SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by direc…
-
Unscored —
SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions…
-
Unscored —
Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.…
Revision history
-
#3
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#2
Updated Advisory (only visual changes)
-
#1
Initial Release
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
http://ics-cert.us-cert.gov/content/recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1