PT-2022-27056 · Sick · Sick Sim2X00

Published 2022-11-01 · Updated 2023-03-31 · CVE-2022-43989

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 versions prior to 1.2.0

Description A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as RecoverableUserLevel. This results in increased privileges on the system, affecting confidentiality, integrity, and availability. An attacker can expect repeatable success by exploiting this issue.

Recommendations For SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 versions prior to 1.2.0, update the firmware to a version >= 1.2.0 as soon as possible, available in the SICK Support Portal.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-43989

Affected Products

Sick Sim2X00

References · 3

• https://osv.dev/vulnerability/CVE-2022-43989 · Vendor Advisory
• https://sick.com/psirt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43989 · Security Note