Critical SCA-2025-0003 16 CVEs

FreeRTOS Vulnerabilities have no impact on SICK Products

Published Feb 28, 2025 · Updated Apr 17, 2026 · Revision 4

Vendor: SICK Product: ANM58B Product: ANM58B firmware Product: ANS58B Product: ANS58B firmware Product: DCM4 Product: DCM4 firmware Product: deTec4 Product: deTec4 firmware Product: deTem2 Core A/P Product: deTem4 Product: deTem4 A/P Product: deTem4 A/P firmware Product: deTem4 Core A/P Product: deTem4 Core A/P firmware Product: deTem4 firmware Product: deTem4 LT Muting A/P Product: deTem4 LT Muting A/P firmware Product: DMM4 Product: DMM4 firmware Product: FXL1 Product: FXL1 firmware Product: safeVisionary2 Product: safeVisionary2 firmware Product: scanGrid2 Product: scanGrid2 firmware Product: SE1 Product: SE1 firmware

Summary

FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

Vulnerabilities 16

High 8.8

CVE-2024-28115

Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code inje…

FreeRTOS FreeRTOS-Kernel

Mar 7, 2024
Unscored —

CVE-2018-16523

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Conn…

Dec 6, 2018
Unscored —

CVE-2018-16524

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Conn…

Dec 6, 2018
Unscored —

CVE-2018-16525

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Conn…

Dec 6, 2018
Unscored —

CVE-2018-16526

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Conn…

Dec 6, 2018
Unscored —

CVE-2018-16527

Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Conn…

Dec 6, 2018
Unscored —

CVE-2018-16598

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2018-16599

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2018-16600

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2018-16601

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2018-16602

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2018-16603

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP)…

Dec 6, 2018
Unscored —

CVE-2021-31571

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.

Apr 22, 2021
Unscored —

CVE-2021-31572

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.

Apr 22, 2021
Unscored —

CVE-2021-32020

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap mem…

May 3, 2021
Unscored —

CVE-2021-43997

FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal fu…

Nov 17, 2021

Revision history

2026-04-17 #4
Added product: DCM4 (status: known not affected) and adjusted version ranges for: DMM4, deTec4, deTem4, deTem4 A/P (all versions marked as known not affected)
2025-07-30 #3
Updated Advisory: URL for SICK Operating Guidelines has been updated
2025-05-20 #2
Added two products: ANS58 and ANM58. Both have the product status 'Known Not Affected'.
2025-02-28 #1
Initial version

References

SICK PSIRT Security Advisories
https://sick.com/psirt
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1