PT-2021-3491 · Sick · Sick Visionary-S Cx

Published 2021-06-25 · Updated 2021-07-02 · CVE-2021-32496

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SICK Visionary-S CX up version 5.21.2.29154R

Description The issue concerns an Inadequate Encryption Strength vulnerability related to the internal SSH interface used by SICK for recovering returned devices. The use of weak ciphers makes it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.

Recommendations For SICK Visionary-S CX version 5.21.2.29154R, consider disabling the internal SSH interface until a patch is available to mitigate the risk of exploitation. Restrict access to the network on which the device is connected to minimize the risk of an attacker breaking the security that protects information transmitted from the client to the SSH server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2021-03521

CVE-2021-32496

Affected Products

Sick Visionary-S Cx

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-32496 · Security Note
• https://sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03521 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32496 · Vendor Advisory
• https://t.me/cvenotify/16766 · Telegram Post
• https://t.me/cibsecurity/25736 · Telegram Post