SICK SIM Series 访问控制错误漏洞

SICK SIM Series is a series of sensor integrators from SICK, Germany. An access control error vulnerability exists in SICK SIM Series 2x00 ARM Partnumber 1092673 and 1081902 version 1.2.0 and earlier. An attacker accesses a user level defined as RecoverableUserLevel by invoking the Password...

CVE-2022-27584

Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby...

SICK SIM Series 访问控制错误漏洞

SICK SIM Series is a series of sensor integrators from SICK, Germany. An access control error vulnerability exists in SICK SIM Series Partnumber versions 2086502 and 1080579, which stems from a vulnerability that allows an unprivileged, remote attacker to access a user level defined as...

SICK Flexi Compact 安全漏洞

SICK Flexi Compact is a safety controller from SICK Germany. A security vulnerability exists in the SICK Flexi Compact FLX3-CPUC1 and FLX3-CPUC2, which arises from a remote, unprivileged attacker being able to interact with the running configuration interface thereby potentially affecting the...

Password recovery vulnerability affects multiple SICK SIMs

SICK received a report about a vulnerability in multiple SICK SIM products. The vulnerability is classified as a "Missing Authentication for Critical Function" vulnerability and results from a mishandling of access to a password recovery mechanism. It is possible for an unprivileged, remote user ...

Playing Doom on a John Deere tractor with Sick Codes: Lock and Code S03E18

In 1993, the video game developers at id Software released Doom, a first-person shooter that placed a nameless protagonist into the fiery depths of hell, equipped with an arsenal of weapons to mow down imps, demons, lost souls, and the intimidating "Barons of Hell." In 2022, the hacker Sick Codes...

OpenSSL vulnerability affects multiple SICK SIMs

In March 2022, the OpenSSL development team disclosed a denial of service in versions "3.0.0," "3.0.1," "1.1.1"-"1.1.1m" and "1.0.2-1.0.2zc" of the OpenSSL library. Exploiting this vulnerability allows remote, unauthenticated attackers to cause an infinite loop. It is possible to trigger the...

SICK FTMg 安全漏洞

The SICK FTMg is a flow sensor from SICK. A security vulnerability exists in SICK FTMg versions prior to 2.8, which stems from the fact that an unauthenticated user can access sensitive Web URLs via a GET request, which should be limited to maintenance users only. A malicious attacker could use...

Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET

The PSIRT received a report about a vulnerability in the Gateway Flexi Soft and microScan3 PROFINET. The vulnerability is classified as a denial-of-service vulnerability and results form a mishandling of Read Implicit Request services...

Vulnerabilities in SICK MARSIC300

SICK received a report about multiple security vulnerabilities in the SICK MARSIC300 device. The security vulnerabilities are caused by the third-party library Dropbear, which is used by the SICK MARSIC300 to provide SSH communication. A successful exploitation of these vulnerabilities could lead...

CVE-2022-27578

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2022-27578

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2022-27578

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2022-27577

The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These forged packets could compromise servic...

Privilege escalation

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2022-27577

The CVE-2022-27577 vulnerability affects SICK MSC800 PLCs (all versions before 4.15). The root cause is a TCP initial sequence number that can be predicted, enabling an attacker to send forged packets that appear to originate from a trusted host and potentially compromise MSC800 services. Affecte...

CVE-2022-27577

The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These forged packets could compromise servic...

CVE-2022-27578

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2022-27578

CVE-2022-27578 affects SICK OEE. A privilege escalation is possible when the OEE application is installed in a directory that non-authenticated or low-privilege users can modify. Root cause: write-access to application content enables elevation. Impact: local privilege escalation with high/confid...

Vulnerability in SICK MSC800

SICK received a report about a vulnerability in the SICK MSC800. An attacker could compromise services on the MSC800 by a TCP sequence prediction attack if a vulnerable version is used...