RCE in Sick Ag Inspectorp61x
CVE-2024-10771
Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (64.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 64.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: +0.000
Affected products
- Sick Ag Inspectorp61x — versions 0
- Sick Ag Inspectorp62x — versions 0
- Sick Ag Tdc-X401gl — versions all versions
- Sick Ag Tim3xx — versions 0
Weakness classification (CWE)
References
- sick.com/psirt (x_SICK PSIRT Website)
- cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_I… (x_SICK Operating Guidelines)
- www.cisa.gov/resources-tools/resources/ics-recommended-practices (x_ICS-CERT recommended practices on Industrial Security)
- www.first.org/cvss/calculator/3.1 (x_CVSS v3.1 Calculator)
- www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf (vendor-advisory)
- www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json (vendor-advisory, x_csaf)
Frequently asked questions
- What is CVE-2024-10771?
- CVE-2024-10771 is a high-severity vulnerability in Sick Ag Inspectorp61x, classified under Code Injection. CVSS score: 8.8/10. Published 2024-12-06.
- How severe is CVE-2024-10771?
- High severity. CVSS v3 base score is 8.8 out of 10.