Summary
SICK has found two vulnerabilities that affect the SICK Flexi Compact.
The vulnerabilities may affect the availability and confidentiality of the products.
SICK is currently not aware of any public exploits.
Vulnerabilities 2
-
High 7.5
Unauthenticated change of IP adress
A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.
-
Low 3.7
Reuse of salt
The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
Revision history
-
#2
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#1
Initial version
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1