PT-2022-18507 · Sick · Sick Sim1000 Fx

Published 2022-11-01 · Updated 2023-03-31 · CVE-2022-27585

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICK SIM1000 FX Partnumber 1097816 and 1097817 versions prior to 1.6.0

Description A password recovery issue allows an unprivileged remote attacker to gain access to the user level defined as RecoverableUserLevel by invoking the password recovery mechanism method. This leads to an increase in their privileges on the system, affecting the confidentiality, integrity, and availability of the system. An attacker can expect repeatable success by exploiting this issue.

Recommendations For SICK SIM1000 FX Partnumber 1097816 and 1097817 versions prior to 1.6.0, update the firmware to a version >= 1.6.0 as soon as possible, available in the SICK Support Portal.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-27585

Affected Products

Sick Sim1000 Fx

References · 3

• https://osv.dev/vulnerability/CVE-2022-27585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27585 · Security Note
• https://sick.com/psirt · Vendor Advisory