Description
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain
full access to the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SICK | SICK InspectorP61x | < <5.0.0 | <5.0.0 |
| SICK | SICK InspectorP62x | < <5.0.0 | <5.0.0 |
| SICK | TiM3xx | < <5.10.0 | <5.10.0 |
Advisories 1
- SCA-2024-0006 Critical vulnerabilities in SICK InspectorP61x, InspectorP62x and TiM3xx SICK PSIRT · Dec 6, 2024
References
- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf vendor-advisory
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json vendor-advisory