Skip to content
OpenAdvisories
High 1 exploited CVE SCA-2022-0002 1 CVE

PwnKit vulnerability affects multiple SICK IPCs

Published Feb 23, 2022 · Updated Feb 23, 2022 · Revision 3

Vendor: SICK Product: ERGO,DISP,KIT,C6X,CUSTOM Product: PC-MXE 5401, CUSTOM, C6, 1TB Product: PC, EOS1300, M16G, 1TB, C7 Product: PC, EOS1300, M16G, 2TB, C7 Product: PC, K700-SE-MS4X, M16G, 1TB Product: PC, MXE-5321, SSAT, R0, 2TB Product: PC, MXE-5321, SSXT, R0, 2TB Product: PC, MXE-5321, UDS, R0, 2TB Product: PC, MXE-5401, SP, R0,2TB Product: PC, MXE-5401, SSAT, R0, 2TB Product: PC, MXE-5401, SSCT, R0, 2TB Product: PC, MXE-5401, UDS, R0, 2TB Product: PC, MXE-5401,R0,2TB,SS-X Product: PC, MXE-5401,R0,2TB,UDS-X Product: PC, MXE5401, M16G, 1TB, C7 Product: PC, MXE5401, M16G, 1TB, LINUX, CUSTOM Product: PC, MXE5401, M16G, 2TB, C7

Summary

CVE-2021-4034 is a Local Privilege Escalation (LPE) vulnerability, located in the "Polkit" package
installed by default on almost every major distribution of the Linux operating system.

On 2022-01-25, Qualys released an advisory for this LPE vulnerability, advising to either update the “Polkit” package or implement the mitigation that Qualys recommends.

In an air-gapped system SICK recommends all customers to implement at least the available mitigation for the corresponding Linux distribution. Please note, that this vulnerability can be exploited only if an user with unprivileged authorization can establish a connection to the systems.

Vulnerabilities 1

Revision history

  1. #3

    Updated Advisory: URL for SICK Operating Guidelines has been updated

  2. #2

    Updated Advisory (only visual changes)

  3. #1

    Initial release

References