CVE-2023-5103: Improper Restriction of Rendered UI Layers or Frames

Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information via tricking a user into clicking on an actionable item using an iframe...

PT-2023-28915

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description Modification of Assumed-Immutable Data MAID in RDT400 allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

PT-2023-28914

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description The issue allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the "FTP server". Recommendations At the moment, there is no informatio...

PT-2023-28918

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description The issue allows an unprivileged remote attacker to modify data via HTTP requests that do not require authentication. This is due to missing authorization in RDT400. Recommendations At the...

PT-2023-28916

Name of the Vulnerable Software and Affected Versions SICK APU RDT400 affected versions not specified Description The issue allows an unprivileged remote attacker to run arbitrary code in the client's browser via injecting code into the website. This is due to improper neutralization of input...

PT-2023-28917

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description The issue allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited due to improper restriction of excessive authentication...

CVE-2023-43700: Missing Authorization

Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication...

CVE-2023-43696: Improper Access Control

Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server...

SICK APU Cross-Site Scripting Vulnerability

SICK APU is a railroad analysis system from SICK, Germany. A security vulnerability exists in the SICK APU RDT400 that stems from the presence of a cross-site scripting XSS vulnerability. An attacker could exploit the vulnerability to run arbitrary code in the client...

CVE-2023-43698: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation ’Cross-site Scripting’ in RDT400 in SICK APU allows an unprivileged remote attacker to run arbitrary code in the clients browser via injecting code into the website...

CVE-2023-43697: Modification of Assumed-Immutable Data (MAID)

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

PT-2023-31735

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description Insufficient Control Flow Management in RDT400 allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests. Recommendations At the moment, there is no...

Vulnerability in SICK SIM1012

To allow full programmability of the SICK SIM1012, all Ethernet ports are open by factory default. If unused ports are not closed, this could potentially allow a remote, unauthenticated attacker to impact the availability, confidentiality, and integrity of the SICK SIM1012. SICK is not aware of a...

Vulnerability in Wibu-Systems CodeMeter Runtime affects multiple SICK products

Wibu-Systems disclosed a security vulnerability in the CodeMeter Runtime. There is a heap buffer overflow vulnerability which can potentially lead to a remote code execution. Currently, no PoC is known to Wibu-Systems. To exploit the heap overflow, additional protection mechanisms need to be...

SICK SIM1012 Security Vulnerability

SICK SIM Series is a series of sensor integrators from SICK, Germany. A security vulnerability exists in the SICK SIM1012. An attacker could use this vulnerability to interact with the device and change configuration settings...

PT-2023-32009 · Sick · Sim1012

Name of the Vulnerable Software and Affected Versions: SICK SIM1012 affected versions not specified Description: A remote unauthorized attacker may connect to the SIM1012, interact with the device, and change configuration settings. The adversary may also reset the SIM and, in the worst case,...

Vulnerabilities in SICK LMS5xx

SICK received a report about multiple vulnerabilities in the SICK LMS5xx, that can be accessed via Ethernet. If exploited, this potentially allows a remote unauthenticated attacker to impact availabiltiy, integrity and confidentaility of the LMS5xx. SICK recommends making sure to run the product ...

CVE-2023-4420

CVE-2023-4420 affects SICK LMS5xx devices. The vulnerability arises from the absence of Transport Layer Security, leaving the communication channel unencrypted and allowing a remote unprivileged attacker to eavesdrop and potentially manipulate data between LMS5xx and the client. Impacts include c...

CVE-2023-4420

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...

CVE-2023-4420

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...