Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-10025

Summary
Assigner-SICK AG
Assigner Org ID-a6863dd2-93fc-443d-bef1-79f0b5020988
Published At-17 Oct, 2024 | 09:58
Updated At-17 Oct, 2024 | 16:33
Rejected At-
Credits

Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:SICK AG
Assigner Org ID:a6863dd2-93fc-443d-bef1-79f0b5020988
Published At:17 Oct, 2024 | 09:58
Updated At:17 Oct, 2024 | 16:33
Rejected At:
▼CVE Numbering Authority (CNA)
Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

Affected Products
Vendor
SICK AGSICK AG
Product
SICK CLV6xx
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
SICK AGSICK AG
Product
SICK Lector6xx
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
SICK AGSICK AG
Product
SICK RFx6xx
Default Status
unaffected
Versions
Affected
  • all versions
Problem Types
TypeCWE IDDescription
CWECWE-798CWE-798 Use of Hard-coded Credentials
Type: CWE
CWE ID: CWE-798
Description: CWE-798 Use of Hard-coded Credentials
Metrics
VersionBase scoreBase severityVector
3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Customers are strongly advised to change their default passwords.

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
1: Initial version2024-10-17 09:53:00
Event: 1: Initial version
Date: 2024-10-17 09:53:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://sick.com/psirt
x_SICK PSIRT Webseite
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
x_ICS-CERT recommended practices on Industrial Security
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
x_SICK Operating Guidelines
https://www.first.org/cvss/calculator/3.1
x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf
vendor-advisory
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json
vendor-advisory
x_csaf
Hyperlink: https://sick.com/psirt
Resource:
x_SICK PSIRT Webseite
Hyperlink: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Resource:
x_ICS-CERT recommended practices on Industrial Security
Hyperlink: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
Resource:
x_SICK Operating Guidelines
Hyperlink: https://www.first.org/cvss/calculator/3.1
Resource:
x_CVSS v3.1 Calculator
Hyperlink: https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf
Resource:
vendor-advisory
Hyperlink: https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json
Resource:
vendor-advisory
x_csaf
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
SICK AGsick
Product
rfu620-10507_firmware
CPEs
  • cpe:2.3:o:sick:lector611_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector610_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector620_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector621_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector622_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector630_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector632_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector640_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector642_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector650_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector651_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:lector654_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv620_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv621_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv622_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv630_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv631_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv632_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv640_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv642_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv650_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:clv651_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10600_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10601_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10603_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10604_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10605_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10607_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10609_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10610_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10613_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10614_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10618_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu610-10700_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10100_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10101_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10102_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10103_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10104_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10105_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10107_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10108_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10111_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10114_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10118_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10400_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10401_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10500_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10501_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10503_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10504_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:sick:rfu620-10507_firmware:-:*:*:*:*:*:*:*
Default Status
unaffected
Versions
Affected
  • From 0 before * (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:psirt@sick.de
Published At:17 Oct, 2024 | 10:15
Updated At:18 Oct, 2024 | 12:52

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-798Secondarypsirt@sick.de
CWE ID: CWE-798
Type: Secondary
Source: psirt@sick.de
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDFpsirt@sick.de
N/A
https://sick.com/psirtpsirt@sick.de
N/A
https://www.cisa.gov/resources-tools/resources/ics-recommended-practicespsirt@sick.de
N/A
https://www.first.org/cvss/calculator/3.1psirt@sick.de
N/A
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.jsonpsirt@sick.de
N/A
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdfpsirt@sick.de
N/A
Hyperlink: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
Source: psirt@sick.de
Resource: N/A
Hyperlink: https://sick.com/psirt
Source: psirt@sick.de
Resource: N/A
Hyperlink: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Source: psirt@sick.de
Resource: N/A
Hyperlink: https://www.first.org/cvss/calculator/3.1
Source: psirt@sick.de
Resource: N/A
Hyperlink: https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json
Source: psirt@sick.de
Resource: N/A
Hyperlink: https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf
Source: psirt@sick.de
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

5Records found
CVE-2022-27583
Matching Score-8
Assigner-SICK AG
ShareView Details
Matching Score-8
Assigner-SICK AG
CVSS Score-9.1||CRITICAL
EPSS-0.12% / 32.46%
||
7 Day CHG~0.00%
Published-31 Oct, 2022 | 00:00
Updated-07 May, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version to potentially impact the availability of the FlexiCompact.

Action-Not Available
Vendor-n/aSICK AG
Product-flx3-cpuc2_firmwareflx3-cpuc1_firmwareflx3-cpuc1flx3-cpuc2SICK FlexiCompact
CWE ID-CWE-285
Improper Authorization
CVE-2023-4419
Matching Score-6
Assigner-SICK AG
ShareView Details
Matching Score-6
Assigner-SICK AG
CVSS Score-9.8||CRITICAL
EPSS-0.73% / 71.79%
||
7 Day CHG~0.00%
Published-24 Aug, 2023 | 18:08
Updated-09 Dec, 2024 | 14:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.

Action-Not Available
Vendor-SICK AG
Product-lms511_firmwarelms511lms500lms531lms500_firmwarelms531_firmwareLMS5xxlms5xx
CWE ID-CWE-798
Use of Hard-coded Credentials
CVE-2019-10979
Matching Score-6
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-6
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-9.8||CRITICAL
EPSS-1.63% / 81.12%
||
7 Day CHG~0.00%
Published-01 Jul, 2019 | 20:05
Updated-04 Aug, 2024 | 22:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.

Action-Not Available
Vendor-SICK AG
Product-msc800msc800_firmwareMSC800
CWE ID-CWE-798
Use of Hard-coded Credentials
CVE-2024-46505
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.06% / 18.90%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 00:00
Updated-23 Jan, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

Action-Not Available
Vendor-n/a
Product-n/a
CWE ID-CWE-276
Incorrect Default Permissions
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CWE ID-CWE-319
Cleartext Transmission of Sensitive Information
CWE ID-CWE-798
Use of Hard-coded Credentials
CVE-2024-57811
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.12% / 31.14%
||
7 Day CHG~0.00%
Published-13 Jan, 2025 | 00:00
Updated-16 Jan, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the firmware. NOTE: This vulnerability appears in versions that are no longer supported by Eaton.

Action-Not Available
Vendor-n/a
Product-n/a
CWE ID-CWE-798
Use of Hard-coded Credentials
Details not found