CVE-2024-10773: SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

Critical severity · published Dec 6, 2024

CVE-2024-10773

SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

9.0

CVSS

0.6%

EPSS

On KEV

Description

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 48% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

SICK InspectorP61x · SICK AG

before <5.0.0 · source: vendor

SICK InspectorP62x · SICK AG

before <5.0.0 · source: vendor

TiM3xx · SICK AG

before <5.10.0 · source: vendor, CISA

Inspector61x Firmware · Sick

before 5.0.0 · source: CISA

Inspector62x Firmware · Sick

before 5.0.0 · source: CISA

Affected product

SICK InspectorP61x

SICK AG

All SICK InspectorP61x CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-10773

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-10773

cdn.sick.com

https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF

sick.com

https://sick.com/psirt

www.cisa.gov

https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

www.first.org

https://www.first.org/cvss/calculator/3.1

www.sick.com

https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json

www.sick.com

https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf