Skip to content
OpenAdvisories
Critical SCA-2023-0007 4 CVEs

Vulnerabilities in SICK LMS5xx

Published Aug 25, 2023 · Updated Aug 25, 2023 · Revision 3

Vendor: SICK Product: LMS5xx

Summary

SICK received a report about multiple vulnerabilities in the SICK LMS5xx, that can be accessed via Ethernet. If exploited, this potentially allows a remote unauthenticated attacker to impact availabiltiy, integrity and confidentaility of the LMS5xx. SICK recommends making sure to run the product in a secure environment and update to the newest firmware version. SICK is not aware of an exploit targeting this vulnerability.

Vulnerabilities 4

  • Critical 9.8
    CVE-2023-4419

    The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigur…

    SICK LMS5xx
  • Critical 9.8
    CVE-2023-4420

    A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transp…

    SICK LMS5xx
  • High 7.5
    CVE-2023-31412

    The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to re…

    SICK LMS5xx
  • High 7.5
    CVE-2023-4418

    A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-b…

    SICK LMS5xx

Revision history

  1. #3

    Updated Advisory: URL for SICK Operating Guidelines has been updated

  2. #2

    Added self reference in CSAF

  3. #1

    Initial Release

References