Lucene search

SICK AGCVE-2022-47377

HistoryDec 16, 2022 - 3:15 p.m.

CVE-2022-47377

2022-12-1615:15:09

CWE-306

CWE-640

SICK AG

web.nvd.nist.gov

cve-2022-47377

sick sim2000st

firmware vulnerability

password recovery

security update

privilege escalation

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).

Affected configurations

Nvd

Node

sicksim2000stMatch-lft

sicksim2000stMatch-ppc

AND

sicksim2000_firmwareRange<1.13.4

VendorProductVersionCPE
sicksim2000st-cpe:2.3:h:sick:sim2000st:-:*:*:*:*:*:lft:*
sicksim2000st-cpe:2.3:h:sick:sim2000st:-:*:*:*:*:*:ppc:*
sicksim2000_firmware*cpe:2.3:o:sick:sim2000_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sick	sim2000st	-	cpe:2.3:h:sick:sim2000st:-::::::lft:
sick	sim2000st	-	cpe:2.3:h:sick:sim2000st:-::::::ppc:
sick	sim2000_firmware	*	cpe:2.3:o:sick:sim2000_firmware::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "SICK SIM2000ST (LFT PPC)",
    "versions": [
      {
        "version": "Partnumber 2086502 with firmware version < 1.13.4",
        "status": "affected"
      }
    ]
  }
]

References

sick.com/psirt

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

Related for CVE-2022-47377