Most recent entries from csaf_sick

SCA-2019-0001 — MSC800 affected by hard-coded credentials vulnerability

Fri, 21 Jun 2019 10:00:00 +0000

The MSC800 uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.

SCA-2019-0002 — Vulnerability in SICK FX0-GENT00000 and SICK FX0-GPNT00000

Fri, 20 Sep 2019 10:00:00 +0000

The SICK FX0-GPNT00000 and SICK FX0-GENT00000 are vulnerable to a buffer overflow by exploiting the available resources with UDP packets, causing the Flexi Soft System to switch to safety state.

SCA-2020-0001 — Security Information Regarding "Profile Programming"

Sun, 31 May 2020 10:00:00 +0000

The functionality profile programming relies in custom CODE128 bar codes that once scanned will trigger certain actions in the device, which can be leveraged to change configuration settings. These custom barcodes do not implement any kind of authentication, so once bar codes are generated, they will work on any SICK device that support them.

As a result, an attacker that is able to physically present a malicious "profile programming" bar code to the affected device can either render it inoperable or change settings to facilitate further attacks.

SCA-2020-0002 — Vulnerabilities in SICK Package Analytics

Fri, 07 Aug 2020 10:00:00 +0000

The affected product is vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly. Passwords are stored in plain text within the configuration of the software. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.

SCA-2020-0003 — MEAC affected by Windows SMBv3 vulnerability

Fri, 07 Aug 2020 10:00:00 +0000

Microsoft disclosed a critical vulnerability in the way Microsoft Server Message Block 3.1.1 (SMBv3) handles compressed connections. That may allow unauthenticated attackers to execute arbitrary code on a vulnerable device. Since the MEAC central emission monitoring computer (EPC) acts as a SMB server to provide MEAC workstations with access to the filesystem in distributed MEAC-systems, the devices are affected by this vulnerability. Exploitation of this vulnerability could lead to remote code execution under login with administrator privileges.

SCA-2020-0004 — Vulnerability in Platform Mechanism AutoIP

Mon, 31 Aug 2020 10:00:00 +0000

SICK received a report from IOActive that informed SICK about a security vulnerability within the platform mechanism AutoIP, used by multiple devices.

SICK recommends updating to the newest version. Refer to the recommended remediations for affected products where no update is available.

Currently SICK is not aware of any public exploits specifically targeting this vulnerability.

SCA-2020-0005 — Package Analytics affected by Windows TCP/IP vulnerability

Thu, 29 Oct 2020 11:00:00 +0000

Microsoft disclosed a critical vulnerability in the way ICMPv6 Router Advertisement packets are handled on Windows 10 and Windows Server 2019. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.

SCA-2021-0001 — Inadequate SSH configuration in SICK Visionary-S CX

Fri, 25 Jun 2021 10:00:00 +0000

SICK received a report that informed SICK about an Inadequate Encryption Strength vulnerability in the SICK product “SICK Visionary-S CX” concerning the internal SSH interface solely used by SICK for recovering returned devices.

Currently SICK is not aware of any public exploits specifically targeting this vulnerability.

SCA-2021-0002 — MEAC affected by Windows SMBv1 vulnerability

Wed, 04 Aug 2021 10:00:00 +0000

Microsoft disclosed a critical security vulnerability in the Microsoft Server Message Block 1.0 (SMBv1) back in 2017.

Since the MEAC central emission monitoring computer (EPC) has enabled the affected SMBv1 protocol to support older versions of external NAS drives, the devices are affected by this vulnerability. To reduce the overall attack surface, in addition to applying the windows remediation, we recommend disabling SMBv1 as backwards compatibility is no longer required.

A successful exploitation of this vulnerability could lead to remote code execution with administrator privileges.

SCA-2021-0004 — Vulnerabilities in SICK SOPAS ET

Thu, 16 Dec 2021 08:00:00 +0000

SDD files might contain an executable file that will be listed as the Emulators inside SOPAS ET. When a user starts the emulator, the executable is run without further checks. Attackers could wrap any executable file into an SDD and provide this to a SOPAS ET user. When installing the SDD the user may not be aware about the executable inside of the SDD. When an SDD contains an emulator, the emulator location is part of the SDD manifest. Attackers could manipulate this location and use path traversal to target an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET, the corresponding executable will be started instead of the emulator. The command line arguments that are passed to an emulator when starting it via SOPAS ET, are part of the SDD manifest. Attackers could manipulate the arguments to pass in any value to the executable. In combination with CVE-2021-32498 the attacker could target an arbitrary executable with any arguments on the host system.