Paper/Archive/CVE-2024-10773

CVE-2024-10773

SICK AG SICK InspectorP61x — SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

EPSS 0.6%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 48.3.483 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.

Affected

ProductAffectedFixed inSource

SICK InspectorP61x< <5.0.0<5.0.0CNA

SICK InspectorP62x< <5.0.0<5.0.0CNA

TiM3xx< <5.10.0<5.10.0CNA

inspector61x_firmware< 5.0.05.0.0CISA-ADP

inspector62x_firmware< 5.0.05.0.0CISA-ADP

tim3xx< 5.10.05.10.0CISA-ADP

Scores by source

SICK AG (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsick.com/psirt refcdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF refcisa.gov/resources-tools/resources/ics-recommended-practices reffirst.org/cvss/calculator/3.1 advisorysick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf advisorysick.com/.well-known/csaf/white/2024/sca-2024-0006.json