PT-2022-18508 · Sick · Sick Sim1004

Published 2022-11-01 · Updated 2023-03-31 · CVE-2022-27586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICK SIM1004 Partnumber 1098148 versions prior to 2.0.0

Description A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as RecoverableUserLevel. This results in increased privileges on the system, affecting confidentiality, integrity, and availability. An attacker can expect repeatable success by exploiting this issue.

Recommendations For SICK SIM1004 Partnumber 1098148 versions prior to 2.0.0, update the firmware to a version >= 2.0.0 as soon as possible, available in the SICK Support Portal.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-27586

Affected Products

Sick Sim1004

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-27586 · Security Note
• https://sick.com/psirt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27586 · Vendor Advisory