Paper/Archive/CVE-2025-27593

CVE-2025-27593

SICK AG SICK DL100-2xxxxxxx — RCE due to Device Driver

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 35.3.353 × 207.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.

Affected

ProductAffectedFixed inSource

SICK DL100-2xxxxxxxall versions–CNA

Scores by source

SICK AG (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsick.com/psirt refcdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF refcisa.gov/resources-tools/resources/ics-recommended-practices reffirst.org/cvss/calculator/3.1 advisorysick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf advisorysick.com/.well-known/csaf/white/2025/sca-2025-0004.json writeupgithub.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html