Summary
SICK received a report about a vulnerability in the SICK Support Portal supportportal.sick.com, which was hosted and operated by a third-party service provider.
Due to a misconfiguration, the access restriction of a NFS (Network File System) storage system has failed, which resulted in temporary unauthorized access to the file share. SICK initiated remediating measures immediately after becoming aware of the security incident. SICK requested all available log data and carried out a comprehensive analysis. The SICK incident response team analysed the data and found product related files that could enable an attacker to potentially impact the availabilty, integrity and confidentiality of the affected products. To reduce the risk to our customers, SICK provided mitigations for the affected products.
It is highly recommended to upgrade the affected products to the latest release or implement the suggested workarounds.
Revision history
-
#3
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#2
Updated titel and description.
-
#1
Initial version
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1