Search
Find a vulnerability
Search criteria
4 vulnerabilities found for TiM3xx by SICK AG
CVE-2024-10773 (GCVE-0-2024-10773)
Vulnerability from nvd – Published: 2024-12-06 12:31 – Updated: 2024-12-09 14:44
VLAI
Title
SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks
Summary
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain
full access to the device.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://sick.com/psirt | x_SICK PSIRT Website |
| https://cdn.sick.com/media/docs/1/11/411/Special_… | x_SICK Operating Guidelines |
| https://www.cisa.gov/resources-tools/resources/ic… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.first.org/cvss/calculator/3.1 | x_CVSS v3.1 Calculator |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisory |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisoryx_csaf |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| SICK AG | SICK InspectorP61x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | SICK InspectorP62x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | TiM3xx |
Affected:
0 , < <5.10.0
(custom)
|
|
| sick | inspector61x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:* |
|
| sick | inspector62x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:* |
|
| sick | tim3xx |
Affected:
0 , < 5.10.0
(custom)
cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:* |
Date Public
2024-12-06 12:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector61x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector62x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tim3xx",
"vendor": "sick",
"versions": [
{
"lessThan": "5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T14:37:48.545525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T14:44:36.597Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP61x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP62x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TiM3xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Stotz"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Jaeger"
}
],
"datePublic": "2024-12-06T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
}
],
"value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-06T12:31:10.776Z",
"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"shortName": "SICK AG"
},
"references": [
{
"tags": [
"x_SICK PSIRT Website"
],
"url": "https://sick.com/psirt"
},
{
"tags": [
"x_SICK Operating Guidelines"
],
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"tags": [
"x_CVSS v3.1 Calculator"
],
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
},
{
"tags": [
"vendor-advisory",
"x_csaf"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
}
],
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
}
],
"source": {
"advisory": "SCA-2024-0006",
"discovery": "EXTERNAL"
},
"title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"assignerShortName": "SICK AG",
"cveId": "CVE-2024-10773",
"datePublished": "2024-12-06T12:31:10.776Z",
"dateReserved": "2024-11-04T13:07:00.547Z",
"dateUpdated": "2024-12-09T14:44:36.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10771 (GCVE-0-2024-10771)
Vulnerability from nvd – Published: 2024-12-06 12:24 – Updated: 2026-05-13 12:04
VLAI
Title
SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution
Summary
Due to missing input validation during one step of the firmware update process, the product
is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker
can execute arbitrary system commands in the root user’s contexts.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://sick.com/psirt | x_SICK PSIRT Website |
| https://cdn.sick.com/media/docs/1/11/411/Special_… | x_SICK Operating Guidelines |
| https://www.cisa.gov/resources-tools/resources/ic… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.first.org/cvss/calculator/3.1 | x_CVSS v3.1 Calculator |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisory |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisoryx_csaf |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| SICK AG | SICK InspectorP61x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | SICK InspectorP62x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | TiM3xx |
Affected:
0 , < <5.10.0
(custom)
|
|
| SICK AG | TDC-X401GL |
Affected:
all versions
|
|
| sick | inspector61x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:* |
|
| sick | inspector62x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:* |
|
| sick | tim3xx |
Affected:
0 , < 5.10.0
(custom)
cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:* |
Date Public
2024-12-06 12:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector61x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector62x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tim3xx",
"vendor": "sick",
"versions": [
{
"lessThan": "5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T14:46:19.943493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T14:47:30.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP61x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP62x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TiM3xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TDC-X401GL",
"vendor": "SICK AG",
"versions": [
{
"status": "affected",
"version": "all versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Stotz"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Jaeger"
}
],
"datePublic": "2024-12-06T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."
}
],
"value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T12:04:13.962Z",
"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"shortName": "SICK AG"
},
"references": [
{
"tags": [
"x_SICK PSIRT Website"
],
"url": "https://sick.com/psirt"
},
{
"tags": [
"x_SICK Operating Guidelines"
],
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"tags": [
"x_CVSS v3.1 Calculator"
],
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
},
{
"tags": [
"vendor-advisory",
"x_csaf"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
}
],
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
}
],
"source": {
"advisory": "SCA-2024-0006",
"discovery": "EXTERNAL"
},
"title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For TiM3xx:\u0026nbsp;\n\nWe recommend updating the firmware only in a trusted environment."
}
],
"value": "For TiM3xx:\u00a0\n\nWe recommend updating the firmware only in a trusted environment."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For\u0026nbsp;TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability."
}
],
"value": "For\u00a0TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"assignerShortName": "SICK AG",
"cveId": "CVE-2024-10771",
"datePublished": "2024-12-06T12:24:40.610Z",
"dateReserved": "2024-11-04T13:06:55.136Z",
"dateUpdated": "2026-05-13T12:04:13.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10773 (GCVE-0-2024-10773)
Vulnerability from cvelistv5 – Published: 2024-12-06 12:31 – Updated: 2024-12-09 14:44
VLAI
Title
SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks
Summary
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain
full access to the device.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://sick.com/psirt | x_SICK PSIRT Website |
| https://cdn.sick.com/media/docs/1/11/411/Special_… | x_SICK Operating Guidelines |
| https://www.cisa.gov/resources-tools/resources/ic… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.first.org/cvss/calculator/3.1 | x_CVSS v3.1 Calculator |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisory |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisoryx_csaf |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| SICK AG | SICK InspectorP61x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | SICK InspectorP62x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | TiM3xx |
Affected:
0 , < <5.10.0
(custom)
|
|
| sick | inspector61x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:* |
|
| sick | inspector62x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:* |
|
| sick | tim3xx |
Affected:
0 , < 5.10.0
(custom)
cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:* |
Date Public
2024-12-06 12:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector61x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector62x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tim3xx",
"vendor": "sick",
"versions": [
{
"lessThan": "5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T14:37:48.545525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T14:44:36.597Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP61x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP62x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TiM3xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Stotz"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Jaeger"
}
],
"datePublic": "2024-12-06T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
}
],
"value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-06T12:31:10.776Z",
"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"shortName": "SICK AG"
},
"references": [
{
"tags": [
"x_SICK PSIRT Website"
],
"url": "https://sick.com/psirt"
},
{
"tags": [
"x_SICK Operating Guidelines"
],
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"tags": [
"x_CVSS v3.1 Calculator"
],
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
},
{
"tags": [
"vendor-advisory",
"x_csaf"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
}
],
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
}
],
"source": {
"advisory": "SCA-2024-0006",
"discovery": "EXTERNAL"
},
"title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"assignerShortName": "SICK AG",
"cveId": "CVE-2024-10773",
"datePublished": "2024-12-06T12:31:10.776Z",
"dateReserved": "2024-11-04T13:07:00.547Z",
"dateUpdated": "2024-12-09T14:44:36.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10771 (GCVE-0-2024-10771)
Vulnerability from cvelistv5 – Published: 2024-12-06 12:24 – Updated: 2026-05-13 12:04
VLAI
Title
SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution
Summary
Due to missing input validation during one step of the firmware update process, the product
is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker
can execute arbitrary system commands in the root user’s contexts.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://sick.com/psirt | x_SICK PSIRT Website |
| https://cdn.sick.com/media/docs/1/11/411/Special_… | x_SICK Operating Guidelines |
| https://www.cisa.gov/resources-tools/resources/ic… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.first.org/cvss/calculator/3.1 | x_CVSS v3.1 Calculator |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisory |
| https://www.sick.com/.well-known/csaf/white/2024/… | vendor-advisoryx_csaf |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| SICK AG | SICK InspectorP61x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | SICK InspectorP62x |
Affected:
0 , < <5.0.0
(custom)
|
|
| SICK AG | TiM3xx |
Affected:
0 , < <5.10.0
(custom)
|
|
| SICK AG | TDC-X401GL |
Affected:
all versions
|
|
| sick | inspector61x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:* |
|
| sick | inspector62x_firmware |
Affected:
0 , < 5.0.0
(custom)
cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:* |
|
| sick | tim3xx |
Affected:
0 , < 5.10.0
(custom)
cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:* |
Date Public
2024-12-06 12:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector61x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspector62x_firmware",
"vendor": "sick",
"versions": [
{
"lessThan": "5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tim3xx",
"vendor": "sick",
"versions": [
{
"lessThan": "5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T14:46:19.943493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T14:47:30.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP61x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP62x",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TiM3xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "\u003c5.10.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TDC-X401GL",
"vendor": "SICK AG",
"versions": [
{
"status": "affected",
"version": "all versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Stotz"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Jaeger"
}
],
"datePublic": "2024-12-06T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."
}
],
"value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T12:04:13.962Z",
"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"shortName": "SICK AG"
},
"references": [
{
"tags": [
"x_SICK PSIRT Website"
],
"url": "https://sick.com/psirt"
},
{
"tags": [
"x_SICK Operating Guidelines"
],
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"tags": [
"x_CVSS v3.1 Calculator"
],
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
},
{
"tags": [
"vendor-advisory",
"x_csaf"
],
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
}
],
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
}
],
"source": {
"advisory": "SCA-2024-0006",
"discovery": "EXTERNAL"
},
"title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For TiM3xx:\u0026nbsp;\n\nWe recommend updating the firmware only in a trusted environment."
}
],
"value": "For TiM3xx:\u00a0\n\nWe recommend updating the firmware only in a trusted environment."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For\u0026nbsp;TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability."
}
],
"value": "For\u00a0TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"assignerShortName": "SICK AG",
"cveId": "CVE-2024-10771",
"datePublished": "2024-12-06T12:24:40.610Z",
"dateReserved": "2024-11-04T13:06:55.136Z",
"dateUpdated": "2026-05-13T12:04:13.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}