Summary
SICK received a report about a vulnerability in the SICK RFU6XX RADIO FREQUEN. SENSOR.
The used SSH service allowed for weak cipher suites to be used in traffic encryption.
If weak cipher suites are used for traffic encryption, an attacker could potentially decrypt the traffic, which would affect the confidentiality of the transferred data.
For the vulnerability to be exploited, the victim must request weak cipher suites from the SSH service to encrypt the data.
SICK has released a new version of the SICK RFU6XX RADIO FREQUEN. SENSOR. and recommends updating to the newest version.
Vulnerabilities 4
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote …
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote …
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote…
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote…
Revision history
-
#3
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#2
Updated Advisory (only visual changes)
-
#1
Initial release
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
http://ics-cert.us-cert.gov/content/recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1