CVE-2022-47377

Critical

Description

Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).

SeverityCritical

CVSS9.8

Exploit probability61. percentile0.9%

ProductSick Sim2000 Firmware

PublishedDec 16, 2022

First seenDec 16, 2022

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

sick sim2000_firmware1.13.4 or later

Affected products

Product	Affected versions	Fixed in
sick sim2000_firmware	v < 1.13.4	1.13.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.