PT-2022-27058 · Sick · Sick Sim1012

Published 2022-11-01 · Updated 2023-03-31 · CVE-2022-43990

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SICK SIM1012 Partnumber 1098146 versions prior to 2.2.0

Description A password recovery issue allows an unprivileged remote attacker to gain access to the RecoverableUserLevel by invoking the password recovery mechanism method, leading to increased privileges on the system and affecting its confidentiality, integrity, and availability. An attacker can expect repeatable success by exploiting this issue.

Recommendations For SICK SIM1012 Partnumber 1098146 versions prior to 2.2.0, update the firmware to a version >= 2.2.0 as soon as possible, available in the SICK Support Portal.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-43990

Affected Products

Sick Sim1012

References · 4

• https://osv.dev/vulnerability/CVE-2022-43990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43990 · Security Note
• https://sick.com/psirt · Vendor Advisory
• https://t.me/cibsecurity/52415 · Telegram Post