Description
Due to missing input validation during one step of the firmware update process, the product
is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker
can execute arbitrary system commands in the root user’s contexts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SICK | SICK InspectorP61x | < <5.0.0 | <5.0.0 |
| SICK | SICK InspectorP62x | < <5.0.0 | <5.0.0 |
| SICK | TiM3xx | < <5.10.0 | <5.10.0 |
| SICK | TDC-X401GL | all versions | — |
Advisories 2
- SCA-2026-0001 Vulnerabilities affecting SICK TDC-X401GL SICK PSIRT · Jan 15, 2026
- SCA-2024-0006 Critical vulnerabilities in SICK InspectorP61x, InspectorP62x and TiM3xx SICK PSIRT · Dec 6, 2024
References
- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json vendor-advisory