75 results · Feed
-
Critical max 9.8
Vulnerability in SICK SIM1012
To allow full programmability of the SICK SIM1012, all Ethernet ports are open by factory default. If unused ports are not closed, this could potentially allow a remote, unauthenticated attacker to impact the availability, confidentiality, and integrity of th…
-
Critical max 9.8
Vulnerability in Wibu-Systems CodeMeter Runtime affects multiple SICK products
Wibu-Systems disclosed a security vulnerability in the CodeMeter Runtime. There is a heap buffer overflow vulnerability which can potentially lead to a remote code execution. Currently, no PoC is known to Wibu-Systems. To exploit the heap overflow, additional…
-
Critical max 9.8
Vulnerabilities in SICK LMS5xx
SICK received a report about multiple vulnerabilities in the SICK LMS5xx, that can be accessed via Ethernet. If exploited, this potentially allows a remote unauthenticated attacker to impact availabiltiy, integrity and confidentaility of the LMS5xx. SICK reco…
-
High max 8.6
Vulnerabilities in SICK ICR890-4
SICK has found several security vulnerabilities in the SICK ICR890-4. If exploited, these could allow an unauthenticated remote attacker to compromise the availability or confidentiality of the SICK ICR890-4. Currently, SICK is not aware of any public exploit…
-
Critical max 9.8
Vulnerabilities in SICK EventCam App
SICK discovered vulnerabilities in the SICK EventCam App, that can be accessed via Ethernet. If exploited, this potentially allows a remote unauthenticated attacker to impact availabiltiy, integrity and confidentaility of the EventCam App. SICK recommends mak…
-
High max 7.5
Vulnerabilities in SICK FTMg
SICK found multiple security vulnerabilities in the SICK FTMg device. If exploited, these potentially allow a remote unauthenticated attacker to impact the availabiltiy or confidentaility of the FTMg device. Currently SICK is not aware of any public exploits …
-
High max 7.5
Vulnerability in SICK Flexi Soft and Flexi Classic Gateways
SICK discovered a vulnerability in several Flexi Classic and Flexi Soft Gateways. If exploited, this potentially allows a remote unauthenticated attacker to impact the availabiltiy of the gateways. SICK is not aware of an exploit targeting this vulnerability.
-
Critical max 9.8
Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways
Several versions of the SICK Flexi Soft Gateways FX0-GENT, FX0-GMOD, FX0-GPNT and SICK Flexi Classic Gateway UE410 provide a Telnet interface for debugging, which is enabled by factory default. No password is set in the default configuration. If the password …
-
Critical max 9.8
Bootloader mode vulnerability in Flexi Soft Gateways v3
The SICK PSIRT received a report about a Missing Authentication for Critical Function vulnerability in the firmware of FX0-GPNT v3 and FX0-GENT v3. This vulnerability was introduced with the hardware redesign of the v3 of FX0-GENT and FX0-GPNT as part of the …
-
Medium max 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU6xx RADIO FREQUEN. SENSOR
SICK received a report about a vulnerability in the SICK RFU6XX RADIO FREQUEN. SENSOR. The used SSH service allowed for weak cipher suites to be used in traffic encryption. If weak cipher suites are used for traffic encryption, an attacker could potentially d…
-
Critical max 9.8
Password recovery vulnerability affects multiple SICK SIMs
SICK received a report about a vulnerability in multiple SICK SIM products. The vulnerability is classified as a "Missing Authentication for Critical Function" vulnerability and results from a mishandling of access to a password recovery mechanism. It is poss…
first Oct 21, 2022 -
Medium max 9.1
SICK FlexiCompact affected by Denial of Service vulnerability
SICK discovered a vulnerability in the configuration interface of FlexiCompact that can be accessed via Ethernet or USB. If exploited, this potentially allows a remote unauthenticated attacker to impact availabiltiy of the FlexiCompact. SICK recommends making…
-
High max 7.5
OpenSSL vulnerability affects multiple SICK SIMs
In March 2022, the OpenSSL development team disclosed a denial of service in versions "3.0.0," "3.0.1," "1.1.1"-"1.1.1m" and "1.0.2-1.0.2zc" of the OpenSSL library. Exploiting this vulnerability allows remote, unauthenticated attackers to cause an infinite lo…
first Aug 8, 2022 -
High
Vulnerability in SICK Flexi Soft Designer & Safety Designer
A deserialization vulnerability in a .NET framework class used by both SICK Flexi Soft Designer and SICK Safety Designer allows an attacker to create malicious project files.
first May 16, 2022 -
Critical max 9.8
Vulnerabilities in SICK Package Analytics
SICK received a report about multiple vulnerabilities in the SICK Package Analytics. The vulnerabilities result from the used MySQL database with version 5.7.25. The vulnerable MySQL version include Buffer-Overflow, Improper Access Control, and Improper Certi…
-
High
Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET
The PSIRT received a report about a vulnerability in the Gateway Flexi Soft and microScan3 PROFINET. The vulnerability is classified as a denial-of-service vulnerability and results form a mishandling of Read Implicit Request services.
-
Medium
Vulnerability in SICK Gateways for Flexi Soft, Flexi Compact, SICK EFI Gateway UE4740, SICK microScan3 and outdoorScan3
The PSIRT received a report about a vulnerability in some gateways for Flexi Soft, Flexi Compact, EFI gateway UE4740, microScan3 and the outdoorScan3. The vulnerability is classified as a denial-of-service vulnerability and results from a malformed UDP packag…
-
Critical
Vulnerabilities in SICK MARSIC300
SICK received a report about multiple security vulnerabilities in the SICK MARSIC300 device. The security vulnerabilities are caused by the third-party library Dropbear, which is used by the SICK MARSIC300 to provide SSH communication. A successful exploitati…
-
High
Vulnerability in SICK Overall Equipment Effectiveness (OEE)
SICK received a report about a vulnerability in the SICK Overall Equipment Effectiveness (OEE). The services under the OEE application are started in the context of system privileges. An attacker can perform a privilege escalation if the application is instal…
-
Medium
Vulnerability in SICK MSC800
SICK received a report about a vulnerability in the SICK MSC800. An attacker could compromise services on the MSC800 by a TCP sequence prediction attack if a vulnerable version is used.
-
Medium max 4.8
Microsoft vulnerability affects multiple SICK IPCs with SICK MEAC
The CVE-2021-26414 “Windows DCOM Server Security Feature Bypass” was issued by Microsoft, that may affect the functionality of the SICK MEAC software installed on SICK IPCs. **Interpretation**: The vulnerability allows a remote attacker to bypass the Windows …
first Apr 11, 2022 -
Medium
Vulnerabilities in SICK FTMg
SICK received a report about multiple security vulnerabilities in the SICK FTMg device. Currently SICK is not aware of any public exploits specifically targeting any of the vulnerabilities. SICK has released a new version of the SICK FTMg firmware and recomme…
-
High max 7.8
PwnKit vulnerability affects multiple SICK IPCs
CVE-2021-4034 is a Local Privilege Escalation (LPE) vulnerability, located in the "Polkit" package installed by default on almost every major distribution of the Linux operating system. On 2022-01-25, Qualys released an advisory for this LPE vulnerability, ad…
-
Critical
Vulnerability in SICK FieldEcho
WIBU publicly released an advisory for the WIBU product “CodeMeter Runtime Network Server”. The advisory discloses a buffer over-read vulnerability that was found in the WIBU product “CodeMeter Runtime Network Server”. By default the network server functional…
-
Critical max 10.0
SICK Security Advisory for Apache Log4j (CVE-2021-44228)
first Dec 14, 2021 -
High
Vulnerabilities in SICK SOPAS ET
SICK received a report from Eden Bar of Claroty about multiple security vulnerabilities in the SICK SOPAS ET software. An unauthorized attacker could potentially craft a malicious SOPAS Device Driver (SDD) file, that if a user imports that file to SOPAS ET co…
first Dec 16, 2021 -
High max 8.8
MEAC affected by Windows SMBv1 vulnerability
Microsoft disclosed a critical security vulnerability in the Microsoft Server Message Block 1.0 (SMBv1) back in 2017. A successful exploitation of this vulnerability could lead to remote code execution with administrator privileges.
-
Low
Inadequate SSH configuration in SICK Visionary-S CX
SICK received a report that informed SICK about an Inadequate Encryption Strength vulnerability in the SICK product “SICK Visionary-S CX” concerning the internal SSH interface solely used by SICK for recovering returned devices. Currently SICK is not aware of…
-
High max 8.8
Package Analytics affected by Windows TCP/IP vulnerability
Microsoft disclosed a critical vulnerability in the way ICMPv6 Router Advertisement packets are handled on Windows 10 and Windows Server 2019. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target serve…
-
High
Vulnerability in Platform Mechanism AutoIP
SICK received a report from IOActive that informed SICK about a security vulnerability within the platform mechanism AutoIP, used by multiple devices. SICK recommends updating to the newest version. Refer to the recommended remediations for affected products …
-
Critical max 10.0
MEAC affected by Windows SMBv3 vulnerability
Microsoft disclosed a critical vulnerability in the way Microsoft Server Message Block 3.1.1 (SMBv3) handles compressed connections. That may allow unauthenticated attackers to execute arbitrary code on a vulnerable device. Since the MEAC central emission mon…
-
Critical
Vulnerabilities in SICK Package Analytics
SICK received a report about multiple security vulnerabilities in the Package Analytics software. Successful exploitation of these vulnerabilities could allow an unauthorized remote attacker to read and write the configuration of the software, read data direc…
first Aug 7, 2020 -
Unscored
Security Information Regarding "Profile Programming"
The customer IOActive provided a Security Advisory report to SICK AG referring to the feature profile programming with regards to the listed affected products. Certain SICK products support profile programming with bar codes, generated and printed via SOPAS E…
-
High
Vulnerability in SICK FX0-GENT00000 and SICK FX0-GPNT00000
The security-testlab team of Fraunhofer IOSB in Karlsruhe reported a security vulnerability that affects SICK FX0-GPNT00000 and SICK FX0-GENT00000 in the version V3.04.0. The SICK FX0-GPNT00000 and SICK FX0-GENT00000 are vulnerable to a buffer overflow by exp…
-
Critical
MSC800 affected by hard-coded credentials vulnerability
The ICS-CERT reported a security vulnerability that affects MSC800 versions before 4.0. The MSC800 uses hard-coded credentials, which potentially allow low-skilled remote attackers to reconfigure settings and /or disrupt the functionality of the device. Curre…