Paper/Archive/CVE-2023-5288

CVE-2023-5288

SICK AG SIM1012 — A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings.

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 56.6.566 × 2011.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload a new firmware version to the device.

Affected

ProductAffectedFixed inSource

SIM1012all versions–CNA

sim1012all versions–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SICK AG (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsick.com/psirt advisorysick.com/.well-known/csaf/white/2023/sca-2023-0008.pdf refsick.com/.well-known/csaf/white/2023/sca-2023-0008.json