SCA-2025-0001

Vulnerability from csaf_sick - Published: 2025-02-14 14:00 - Updated: 2025-02-21 14:00
Summary
Multiple vulnerabilities in SICK MEAC300
Notes
summary: SICK has identified vulnerabilities in MEAC300. These vulnerabilities, related to the OpenSSL library and specific device functionalities, could potentially allow remote, unauthenticated attackers to: 1) Cause a denial of service: Triggering an infinite loop that consumes CPU resources, rendering the device unresponsive (CVE-2022-0778). This impacts MEAC300 DE devices running vulnerable OpenSSL versions when processing manipulated SSH certificates. 2) Compromise the MEAC300: Exploit vulnerabilities accessible via Ethernet to potentially impact the availability, integrity, and confidentiality of the device. SICK recommends ensuring that affected products operate within secure network environments to mitigate these risks.
General Security Measures: As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification: SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
CVE-2025-0867
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-522 - Insufficiently Protected Credentials
Vendor Fix Users are strongly recommended to upgrade to the latest release of the MEAC300 (>=4.0.54.21) that includes a patch for the vulnerability.
CVE-2022-0778
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Workaround Please make sure that you apply general security practices when operating the MEAC300 DE. The following General Security Practices and Operating Guidelines could mitigate the associated security risk.
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "SICK has identified vulnerabilities in  MEAC300. These vulnerabilities, related to the OpenSSL library and specific device functionalities, could potentially allow remote, unauthenticated attackers to: 1) Cause a denial of service: Triggering an infinite loop that consumes CPU resources, rendering the device unresponsive (CVE-2022-0778). This impacts MEAC300 DE devices running vulnerable OpenSSL versions when processing manipulated SSH certificates. 2) Compromise the MEAC300: Exploit vulnerabilities accessible via Ethernet to potentially impact the availability, integrity, and confidentiality of the device. SICK recommends ensuring that affected products operate within secure network environments to mitigate these risks.",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0001.json"
      }
    ],
    "title": "Multiple vulnerabilities in SICK MEAC300",
    "tracking": {
      "current_release_date": "2025-02-21T14:00:00.000Z",
      "generator": {
        "date": "2025-02-21T11:15:18.650Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.19"
        }
      },
      "id": "SCA-2025-0001",
      "initial_release_date": "2025-02-14T14:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-02-14T01:00:00.000Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-02-21T01:00:00.000Z",
          "number": "2",
          "summary": "Fix provided for CVE-2025-0867"
        },
        {
          "date": "2025-07-30T07:30:49.000Z",
          "number": "3",
          "summary": "Updated Advisory: URL for SICK Operating Guidelines has been updated"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK MEAC300 all versions",
                      "product_id": "CSAFPID-0001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "MEAC300"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "SICK MEAC300 DE all versions",
                      "product_id": "CSAFPID-0002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "MEAC300 DE"
              }
            ],
            "category": "product_family",
            "name": "MEAC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.0.54.21",
                "product": {
                  "name": "SICK MEAC 300 Firmware \u003c4.0.54.21",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=4.0.54.21",
                "product": {
                  "name": "SICK MEAC 300 Firmware \u003e=4.0.54.21",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "MEAC 300 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK MEAC300 DE Firmware all versions",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "MEAC300 DE Firmware"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK MEAC300 all versions with Firmware \u003c4.0.54.21",
          "product_id": "CSAFPID-0006"
        },
        "product_reference": "CSAFPID-0003",
        "relates_to_product_reference": "CSAFPID-0001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK MEAC300 DE all Firmware versions",
          "product_id": "CSAFPID-0007"
        },
        "product_reference": "CSAFPID-0005",
        "relates_to_product_reference": "CSAFPID-0002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK MEAC300 all versions with Firmware \u003e=4.0.54.21",
          "product_id": "CSAFPID-0008"
        },
        "product_reference": "CSAFPID-0004",
        "relates_to_product_reference": "CSAFPID-0001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-0867",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "The standard user uses the runas function to start the MEAC applications with administrative privileges.\nTo ensure that the system can startup on its own, the credentials of the administrator were stored.\nConsequently, the EPC2 user can execute any command with administrative privileges.\nThis allows a privilege escalation to the administrative level.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0008"
        ],
        "known_affected": [
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Users are strongly recommended to upgrade to the latest release of the MEAC300 (\u003e=4.0.54.21) that includes a patch for the vulnerability.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 10,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 9.9,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "Operating System - Privilege Escalation"
    },
    {
      "cve": "CVE-2022-0778",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "Description of the original advisory from OpenSSL: \u201cThe OpenSSL BN mod sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial-of-service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters.\u201d",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "details": "Please make sure that you apply general security practices when operating the MEAC300 DE. The following General Security Practices and Operating Guidelines\ncould mitigate the associated security risk.",
          "product_ids": [
            "CSAFPID-0007"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0007"
          ]
        }
      ],
      "title": "Loop with Unreachable Exit Condition (\u2019Infinite Loop\u2019)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.