RCE in Sick Ag Inspectorp61x
CVE-2024-10771
Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.011 (61.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sick Ag Inspectorp61x — versions 0
- Sick Ag Inspectorp62x — versions 0
- Sick Ag Tdc-x401gl — versions all versions
- Sick Ag Tim3xx — versions 0
Weakness classification (CWE)
References
- psirt@sick.de (x_SICK PSIRT Website)
- psirt@sick.de (x_SICK Operating Guidelines)
- psirt@sick.de (x_ICS-CERT recommended practices on Industrial Security)
- psirt@sick.de (x_CVSS v3.1 Calculator)
- psirt@sick.de (vendor-advisory)
- psirt@sick.de (vendor-advisory, x_csaf)
Frequently asked questions
- What is CVE-2024-10771?
- CVE-2024-10771 is a high-severity vulnerability in Sick Ag Inspectorp61x, classified under Code Injection. CVSS score: 8.8/10. Published 2024-12-06.
- How severe is CVE-2024-10771?
- High severity. CVSS v3 base score is 8.8 out of 10.