Skip to content
OpenAdvisories
Critical SCA-2024-0004 8 CVEs

Third party vulnerabilities in SICK CDE-100

Published Nov 7, 2024 · Updated Nov 7, 2024 · Revision 2

Vendor: SICK Product: CDE-100 Product: CDE-100 Firmware

Summary

The SICK CDE-100 uses the open-source libraries FreeRTOS, lwIP and MCU Boot. The used libraries contain vulnerabilities that affect the SICK CDE-100.

Vulnerabilities 8

  • High 7.7
    CVE-2024-32883

    MCUboot Injection attack of unprotected TLV values

    MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV (tag-length-value) structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The pr…

    mcu-tools mcuboot github.com/mcu-tools/mcuboot Go
  • High 7.4
    CVE-2021-27504

    Texas Instruments FREERTOS Integer Overflow or Wraparound

    Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.

    Texas Instruments SimpleLink MSP432E4XX SimpleLink-CC26XX CC32XX
  • Unscored —
    CVE-2020-22283

    A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation …

    lwip lwip Debian Ubuntu
  • Unscored —
    CVE-2020-22284

    A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version an…

    lwip lwip Debian Ubuntu
  • Unscored —
    CVE-2021-31571

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.

  • Unscored —
    CVE-2021-31572

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.

  • Unscored —
    CVE-2021-32020

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap mem…

  • Unscored —
    CVE-2021-43997

    FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal fu…

Revision history

  1. #2

    Updated Advisory: URL for SICK Operating Guidelines has been updated

  2. #1

    Initial version

References