Summary
SICK has found two vulnerabilities that affect the SICK Lector8xx and SICK InspectorP8xx.
The vulnerabilities may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file or executing low-level functions.
SICK is currently not aware of any public exploits.
Vulnerabilities 2
-
High 8.8
SICK Lector8xx and InspectorP8xx vulnerable for code execution
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.
-
High 8.8
SICK Lector8xx and InspectorP8xx vulnerable for code execution
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.
Revision history
-
#2
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#1
Initial version
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1
-
Lector85x operating instructions
https://cdn.sick.com/media/docs/8/48/648/operating_instructions_lector85x_can_i_o_image_based_code_reader_en_im0101648.pdf
-
Inspector83x operating instructions
https://cdn1.npcdn.net/userfiles/19423/attachment/5023455/20240604_86cc78525f735019023e2f3f65d5c9b9/operating_instructions_inspector83x_2d_machine_vision_en_im0108639.pdf