Critical severity · published Oct 17, 2024
CVE-2024-10025
Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx
9.1
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SICK CLV6xx · SICK AG
all versions · source: vendor
SL
SICK Lector6xx · SICK AG
all versions · source: vendor
SR
SICK RFx6xx · SICK AG
all versions · source: vendor