CVE-2022-27585

Critical

Description

Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.6.0 as soon as possible (available in SICK Support Portal).

SeverityCritical

CVSS9.8

Exploit probability—

ProductSick Sim1000 Fx Firmware

PublishedNov 1, 2022

First seenNov 1, 2022

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

sick sim1000_fx_firmware1.6.0 or later

Affected products

Product	Affected versions	Fixed in
sick sim1000_fx_firmware	v < 1.6.0	1.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.