Summary
SICK has identified vulnerabilities in MEAC300. These vulnerabilities, related to the OpenSSL library and specific device functionalities, could potentially allow remote, unauthenticated attackers to: 1) Cause a denial of service: Triggering an infinite loop that consumes CPU resources, rendering the device unresponsive (CVE-2022-0778). This impacts MEAC300 DE devices running vulnerable OpenSSL versions when processing manipulated SSH certificates. 2) Compromise the MEAC300: Exploit vulnerabilities accessible via Ethernet to potentially impact the availability, integrity, and confidentiality of the device. SICK recommends ensuring that affected products operate within secure network environments to mitigate these risks.
Vulnerabilities 2
-
Critical 9.9
Privilege Escalation in MEAC300
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command w…
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…
Revision history
-
#3
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#2
Fix provided for CVE-2025-0867
-
#1
Initial version
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1