PT-2024-16531 · Sick Ag+1 · Sick Inspectorp61X+4

Manuel Stotz + 2 · Published 2024-12-06 · Updated 2024-12-11 · CVE-2024-10771

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Product (affected versions not specified)

Description The product is vulnerable to remote code execution due to missing input validation during one step of the firmware update process. An attacker with network access and the user level "Service" can execute arbitrary system commands in the root user's context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-10771

Affected Products

Sick Inspectorp61X

Sick Inspectorp62X

Tim3Xx

Inspector61X Firmware

Inspector62X Firmware

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-10771 · Security Note
• https://sick.com/.well-known/csaf/white/2024/sca-2024-0006.json · Vendor Advisory
• https://sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf · Vendor Advisory
• https://twitter.com/cracbot/status/1866724698731712836 · Twitter Post
• https://t.me/cvenotify/103297 · Telegram Post
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/CVEnew/status/1865019104559563086 · Twitter Post
• https://t.me/latest_high_impact_cve/1621 · Telegram Post
• https://twitter.com/CveFindCom/status/1865011507760615430 · Twitter Post
• https://sick.com/psirt · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://t.me/cvedetector/12211 · Telegram Post
• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF · Note