{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "audience": "all",
        "category": "summary",
        "text": "WIBU publicly released an advisory for the WIBU product \u201cCodeMeter Runtime Network Server\u201d. The advisory discloses a buffer over-read vulnerability that was found in the WIBU product \u201cCodeMeter Runtime Network Server\u201d. \n\nBy default the network server functionality is disabled, however the SICK product \u201cFieldEcho\u201d may be vulnerable, if customers enables this.\nSICK has released a new FieldEcho version and recommends updating to the newest version.\n\nSince version 1.5.2 of SICK \u201cFieldEcho\u201d, customer can choose to use their own license server. If so, SICK advises to take action in accordance with the official WIBU Security Advisory.\n"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "http://ics-cert.us-cert.gov/content/recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2022/sca-2022-0001.json"
      }
    ],
    "title": "Vulnerability in SICK FieldEcho",
    "tracking": {
      "current_release_date": "2022-02-17T16:00:00.000Z",
      "generator": {
        "date": "2023-02-10T08:19:04.679Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.0.0"
        }
      },
      "id": "SCA-2022-0001",
      "initial_release_date": "2022-02-17T16:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-02-17T16:00:00.000Z",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2023-02-10T11:00:00.000Z",
          "number": "2",
          "summary": "Updated Advisory (only visual changes)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.5.3",
                "product": {
                  "name": "SICK FieldEcho \u003c1.5.3",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "skus": [
                      "1612993"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "SICK:Website",
                        "uri": "SICK:Website:https://www.sick.com/de/de/p/p597264"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "1.5.3",
                "product": {
                  "name": "SICK FieldEcho 1.5.3",
                  "product_id": "CSAFPID-0002",
                  "product_identification_helper": {
                    "skus": [
                      "1612993"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FieldEcho"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20093",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2021-06-15T15:00:00.000Z",
      "notes": [
        {
          "category": "description",
          "text": "An attacker could send a specially crafted packet that could have the CodeMeter Runtime Network Server send back packets containing data from the heap or crash the server."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "Security Advisory from WIBU",
          "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-17T16:00:00.000Z",
          "details": "Update to latest version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sick.com/de/de/sick-integrationspace/software-for-integration/fieldecho/fieldechoc2ae/p/p597264"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Buffer Over-Read Attack"
    }
  ]
}