PT-2024-16534 · Crown · Crown

Manuel Stotz + 2 · Published 2024-12-06 · Updated 2024-12-06 · CVE-2024-10774

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CROWN (affected versions not specified)

Description The issue allows unauthenticated access to critical functions through CROWN APIs, making large parts of the web application accessible without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-10774

Affected Products

Crown

References · 10

• https://sick.com/.well-known/csaf/white/2024/sca-2024-0006.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10774 · Security Note
• https://sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf · Vendor Advisory
• https://first.org/cvss/calculator/3.1 · Note
• https://t.me/cvenotify/103300 · Telegram Post
• https://sick.com/psirt · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://twitter.com/CVEnew/status/1865019101271281684 · Twitter Post
• https://t.me/cvedetector/12206 · Telegram Post
• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF · Note