by Kastro
Paper/Archive/CVE-2025-0867

CVE-2025-0867

SICK AG SICK MEAC300 — Privilege Escalation in MEAC300

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
40
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 50.1.501 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.

Affected

ProductAffectedFixed inSource
SICK MEAC300< 4.0.54.214.0.54.21CNA

Scores by source

SICK AG (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsick.com/psirtrefcdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDFrefcisa.gov/resources-tools/resources/ics-recommended-practicesreffirst.org/cvss/calculator/3.1advisorysick.com/.well-known/csaf/white/2025/sca-2025-0001.pdfadvisorysick.com/.well-known/csaf/white/2025/sca-2025-0001.json