CVE-2024-10772 (GCVE-0-2024-10772)

Vulnerability from cvelistv5 – Published: 2024-12-06 12:28 – Updated: 2024-12-09 14:46
VLAI
Title
SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification
Summary
Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-649 - Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
Assigner
References
URL Tags
https://sick.com/psirt x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_… x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ic… x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1 x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2024/… vendor-advisory
https://www.sick.com/.well-known/csaf/white/2024/… vendor-advisoryx_csaf
Impacted products
Vendor Product Version
SICK AG SICK InspectorP61x Affected: 0 , < <5.0.0 (custom)
Create a notification for this product.
SICK AG SICK InspectorP62x Affected: 0 , < <5.0.0 (custom)
Create a notification for this product.
Date Public
2024-12-06 12:00
Credits
Manuel Stotz Tobias Jaeger
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "inspector61x_firmware",
            "vendor": "sick",
            "versions": [
              {
                "lessThan": "5.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "inspector62x_firmware",
            "vendor": "sick",
            "versions": [
              {
                "lessThan": "5.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T14:44:58.610795Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-09T14:46:03.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SICK InspectorP61x",
          "vendor": "SICK AG",
          "versions": [
            {
              "lessThan": "\u003c5.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SICK InspectorP62x",
          "vendor": "SICK AG",
          "versions": [
            {
              "lessThan": "\u003c5.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Manuel Stotz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tobias Jaeger"
        }
      ],
      "datePublic": "2024-12-06T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Since the firmware update is not validated, an attacker can install modified firmware on the\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device."
            }
          ],
          "value": "Since the firmware update is not validated, an attacker can install modified firmware on the\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-649",
              "description": "CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-06T12:28:56.564Z",
        "orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
        "shortName": "SICK AG"
      },
      "references": [
        {
          "tags": [
            "x_SICK PSIRT Website"
          ],
          "url": "https://sick.com/psirt"
        },
        {
          "tags": [
            "x_SICK Operating Guidelines"
          ],
          "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
        },
        {
          "tags": [
            "x_ICS-CERT recommended practices on Industrial Security"
          ],
          "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
        },
        {
          "tags": [
            "x_CVSS v3.1 Calculator"
          ],
          "url": "https://www.first.org/cvss/calculator/3.1"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
        },
        {
          "tags": [
            "vendor-advisory",
            "x_csaf"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
            }
          ],
          "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
        }
      ],
      "source": {
        "advisory": "SCA-2024-0006",
        "discovery": "EXTERNAL"
      },
      "title": "SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
    "assignerShortName": "SICK AG",
    "cveId": "CVE-2024-10772",
    "datePublished": "2024-12-06T12:28:56.564Z",
    "dateReserved": "2024-11-04T13:06:59.393Z",
    "dateUpdated": "2024-12-09T14:46:03.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-10772",
      "date": "2026-05-27",
      "epss": "0.00322",
      "percentile": "0.55426"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Since the firmware update is not validated, an attacker can install modified firmware on the\\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.\"}, {\"lang\": \"es\", \"value\": \"Dado que la actualizaci\\u00f3n del firmware no est\\u00e1 validada, un atacante puede instalar un firmware modificado en el dispositivo. Esto tiene un gran impacto en la disponibilidad, integridad y confidencialidad, e incluso puede comprometer por completo el dispositivo.\"}]",
      "id": "CVE-2024-10772",
      "lastModified": "2024-12-06T13:15:05.763",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@sick.de\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-12-06T13:15:05.763",
      "references": "[{\"url\": \"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF\", \"source\": \"psirt@sick.de\"}, {\"url\": \"https://sick.com/psirt\", \"source\": \"psirt@sick.de\"}, {\"url\": \"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices\", \"source\": \"psirt@sick.de\"}, {\"url\": \"https://www.first.org/cvss/calculator/3.1\", \"source\": \"psirt@sick.de\"}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json\", \"source\": \"psirt@sick.de\"}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf\", \"source\": \"psirt@sick.de\"}]",
      "sourceIdentifier": "psirt@sick.de",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"psirt@sick.de\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-649\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-10772\",\"sourceIdentifier\":\"psirt@sick.de\",\"published\":\"2024-12-06T13:15:05.763\",\"lastModified\":\"2024-12-06T13:15:05.763\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Since the firmware update is not validated, an attacker can install modified firmware on the\\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.\"},{\"lang\":\"es\",\"value\":\"Dado que la actualizaci\u00f3n del firmware no est\u00e1 validada, un atacante puede instalar un firmware modificado en el dispositivo. Esto tiene un gran impacto en la disponibilidad, integridad y confidencialidad, e incluso puede comprometer por completo el dispositivo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@sick.de\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@sick.de\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-649\"}]}],\"references\":[{\"url\":\"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://sick.com/psirt\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.first.org/cvss/calculator/3.1\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json\",\"source\":\"psirt@sick.de\"},{\"url\":\"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf\",\"source\":\"psirt@sick.de\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-10772\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-09T14:44:58.610795Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"sick\", \"product\": \"inspector61x_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"sick\", \"product\": \"inspector62x_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-09T14:45:57.356Z\"}}], \"cna\": {\"title\": \"SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification\", \"source\": {\"advisory\": \"SCA-2024-0006\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Manuel Stotz\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Tobias Jaeger\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SICK AG\", \"product\": \"SICK InspectorP61x\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"\u003c5.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"SICK AG\", \"product\": \"SICK InspectorP62x\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"\u003c5.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release.\", \"base64\": false}]}], \"datePublic\": \"2024-12-06T12:00:00.000Z\", \"references\": [{\"url\": \"https://sick.com/psirt\", \"tags\": [\"x_SICK PSIRT Website\"]}, {\"url\": \"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF\", \"tags\": [\"x_SICK Operating Guidelines\"]}, {\"url\": \"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices\", \"tags\": [\"x_ICS-CERT recommended practices on Industrial Security\"]}, {\"url\": \"https://www.first.org/cvss/calculator/3.1\", \"tags\": [\"x_CVSS v3.1 Calculator\"]}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json\", \"tags\": [\"vendor-advisory\", \"x_csaf\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Since the firmware update is not validated, an attacker can install modified firmware on the\\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Since the firmware update is not validated, an attacker can install modified firmware on the\\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-649\", \"description\": \"CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking\"}]}], \"providerMetadata\": {\"orgId\": \"a6863dd2-93fc-443d-bef1-79f0b5020988\", \"shortName\": \"SICK AG\", \"dateUpdated\": \"2024-12-06T12:28:56.564Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-10772\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-09T14:46:03.214Z\", \"dateReserved\": \"2024-11-04T13:06:59.393Z\", \"assignerOrgId\": \"a6863dd2-93fc-443d-bef1-79f0b5020988\", \"datePublished\": \"2024-12-06T12:28:56.564Z\", \"assignerShortName\": \"SICK AG\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.