Vulnerability-Lookup

SCA-2026-0009

Vulnerability from csaf_sick - Published: 2026-07-16 13:00 - Updated: 2026-07-16 13:00

Summary

Vulnerability in several Endress+Hauser products

Notes

Summary: A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.

Impact: If exploited, this vulnerability allows a remote unauthenticated attacker to modify the IP address of the product through the SopasET interface, potentially leading to Denial of Service. There are currently no known public exploits specifically targeting this vulnerability.

Mitigation: As general security measures, it is recommended to minimize network exposure of the devices, restrict network access, and follow recommended security practices in order to operate the devices in a protected IT environment.

Remediation: Customers are strongly advised to apply the recommended mitigation for the affected vulnerabilities to reduce potential risk.

General Recommendation: As general security measures, it is recommended to minimize network exposure of the devices, restrict network access, and follow recommended security practices in order to operate the devices in a protected IT environment.

CVE-2024-8751

A vulnerability allows a remote unauthenticated attacker to modify the product's IP address over the Sopas ET interface. This can lead to a Denial of Service attack.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-306 - Missing Authentication for Critical Function

Affected products

Known affected 16 products

Product	Version	Remediation
Unresolved product id: CSAFPID-31001	—	Mitigation
Unresolved product id: CSAFPID-31002	—	Mitigation
Unresolved product id: CSAFPID-31003	—	Mitigation
Unresolved product id: CSAFPID-31004	—	Mitigation
Unresolved product id: CSAFPID-31005	—	Mitigation
Unresolved product id: CSAFPID-31006	—	Mitigation
Unresolved product id: CSAFPID-31007	—	Mitigation
Unresolved product id: CSAFPID-31008	—	Mitigation
Unresolved product id: CSAFPID-31009	—	Mitigation
Unresolved product id: CSAFPID-31010	—	Mitigation
Unresolved product id: CSAFPID-31011	—	Mitigation
Unresolved product id: CSAFPID-31012	—	Mitigation
Unresolved product id: CSAFPID-31013	—	Mitigation
Unresolved product id: CSAFPID-31015	—	Mitigation
Unresolved product id: CSAFPID-31016	—	Mitigation
Unresolved product id: CSAFPID-31017	—	Mitigation

References

5 references

URL	Category
https://www.endress.com	external
https://sick.com/psirt
https://www.cisa.gov/resources-tools/resources/ic…	external
https://www.first.org/cvss/calculator/3.1	external
https://www.sick.com/.well-known/csaf/white/2026/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "If exploited, this vulnerability allows a remote unauthenticated attacker to modify the IP address of the product through the SopasET interface, potentially leading to Denial of Service. There are currently no known public exploits specifically targeting this vulnerability.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "As general security measures, it is recommended to minimize network exposure of the devices, restrict network access, and follow recommended security practices in order to operate the devices in a protected IT environment.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Customers are strongly advised to apply the recommended mitigation for the affected vulnerabilities to reduce potential risk.",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "As general security measures, it is recommended to minimize network exposure of the devices, restrict network access, and follow recommended security practices in order to operate the devices in a protected IT environment.",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "Endress+Hauser",
        "url": "https://www.endress.com"
      },
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "category": "external",
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2026/SCA-2026-0009.json"
      }
    ],
    "title": "Vulnerability in several Endress+Hauser products",
    "tracking": {
      "aliases": [
        "SCA-2026-0009"
      ],
      "current_release_date": "2026-07-16T13:00:00.000Z",
      "generator": {
        "date": "2026-07-16T13:00:00.000Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.29"
        }
      },
      "id": "SCA-2026-0009",
      "initial_release_date": "2026-07-16T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-16T13:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MARSIC200 all versions",
                          "product_id": "CSAFPID-11001"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MARSIC200"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MARSIC280 all versions",
                          "product_id": "CSAFPID-11002"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MARSIC280"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MARSIC300 all versions",
                          "product_id": "CSAFPID-11003"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MARSIC300"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MCS100FT all versions",
                          "product_id": "CSAFPID-11004"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MCS100FT"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MCS200HW all versions",
                          "product_id": "CSAFPID-11005"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MCS200HW"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MCS300P all versions",
                          "product_id": "CSAFPID-11006"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MCS300P"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MERCEM300Z all versions",
                          "product_id": "CSAFPID-11007"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MERCEM300Z"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser SAM800 all versions",
                          "product_id": "CSAFPID-11008"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "SAM800"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser SIPROCESS all versions",
                          "product_id": "CSAFPID-11009"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "SIPROCESS"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser GMS800 all versions",
                          "product_id": "CSAFPID-11010"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "GMS800"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser GMS800 FIDOR all versions",
                          "product_id": "CSAFPID-11011"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "GMS800 FIDOR"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser GM32 all versions",
                          "product_id": "CSAFPID-11012"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "GM32"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser VICOTEC320 all versions",
                          "product_id": "CSAFPID-11013"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "VICOTEC320"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MCU ETH-Service and Modbus-TCP Module all versions",
                          "product_id": "CSAFPID-11015"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MCU ETH-Service and Modbus-TCP Module"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser FLPS all versions",
                          "product_id": "CSAFPID-11016"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "FLPS"
                  },
                  {
                    "branches": [
                      {
                        "category": "product_version_range",
                        "name": "vers:all/*",
                        "product": {
                          "name": "Endress+Hauser MES1B B\u0026B Converter all versions",
                          "product_id": "CSAFPID-11017"
                        }
                      }
                    ],
                    "category": "product_name",
                    "name": "MES1B B\u0026B Converter"
                  }
                ],
                "category": "product_family",
                "name": "Extractive Analyzer"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MARSIC200 Firmware vers:all/*",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MARSIC280 Firmware vers:all/*",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MARSIC300 Firmware vers:all/*",
                  "product_id": "CSAFPID-21003"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MCS100FT Firmware vers:all/*",
                  "product_id": "CSAFPID-21004"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MCS200HW Firmware vers:all/*",
                  "product_id": "CSAFPID-21005"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MCS300P Firmware vers:all/*",
                  "product_id": "CSAFPID-21006"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MERCEM300Z Firmware vers:all/*",
                  "product_id": "CSAFPID-21007"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SAM800 Firmware vers:all/*",
                  "product_id": "CSAFPID-21008"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIPROCESS Firmware vers:all/*",
                  "product_id": "CSAFPID-21009"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "GMS800 Firmware vers:all/*",
                  "product_id": "CSAFPID-21010"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "GMS800 FIDOR Firmware vers:all/*",
                  "product_id": "CSAFPID-21011"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "GM32 Firmware vers:all/*",
                  "product_id": "CSAFPID-21012"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "VICOTEC320 Firmware vers:all/*",
                  "product_id": "CSAFPID-21013"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MCU ETH-Service and Modbus-TCP Module Firmware vers:all/*",
                  "product_id": "CSAFPID-21015"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "FLPS Firmware vers:all/*",
                  "product_id": "CSAFPID-21016"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "MES1B B\u0026B Converter Firmware vers:all/*",
                  "product_id": "CSAFPID-21017"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Endress+Hauser"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MARSIC200 all firmware versions",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MARSIC280 all firmware versions",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MARSIC300 all firmware versions",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MCS100FT all firmware versions",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MCS200HW all firmware versions",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MCS300P all firmware versions",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21006",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MERCEM300Z all firmware versions",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21007",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser SAM800 all firmware versions",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser SIPROCESS all firmware versions",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21009",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser GMS800 all firmware versions",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21010",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser GMS800 FIDOR all firmware versions",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21011",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser GM32 all firmware versions",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21012",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser VICOTEC320 all firmware versions",
          "product_id": "CSAFPID-31013"
        },
        "product_reference": "CSAFPID-21013",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MCU ETH-Service and Modbus-TCP Module all firmware versions",
          "product_id": "CSAFPID-31015"
        },
        "product_reference": "CSAFPID-21015",
        "relates_to_product_reference": "CSAFPID-11015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser FLPS all firmware versions",
          "product_id": "CSAFPID-31016"
        },
        "product_reference": "CSAFPID-21016",
        "relates_to_product_reference": "CSAFPID-11016"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Endress+Hauser MES1B B\u0026B Converter all firmware versions",
          "product_id": "CSAFPID-31017"
        },
        "product_reference": "CSAFPID-21017",
        "relates_to_product_reference": "CSAFPID-11017"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-8751",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "A vulnerability allows a remote unauthenticated attacker to modify the product\u0027s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.",
          "product_ids": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2024-8751"
    }
  ]
}

CVE-2024-8751 (GCVE-0-2024-8751)

Vulnerability from cvelistv5 – Published: 2024-09-12 21:38 – Updated: 2026-07-16 09:48

Title

CVE-2024-8751

Summary

A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

SICK AG

References

9 references

URL	Tags
https://sick.com/psirt	x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_…	x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ic…	x_ICS-CERT recommended practices on Industrial Security
https://www.first.org/cvss/calculator/3.1	x_CVSS v3.1 Calculator
https://www.sick.com/.well-known/csaf/white/2024/…	vendor-advisory
https://www.sick.com/.well-known/csaf/white/2026/…	vendor-advisory
https://www.sick.com/.well-known/csaf/white/2024/…	x_The canonical URL
https://www.sick.com/.well-known/csaf/white/2026/…	x_The canonical URL
https://www.endress.com	x_Endress+Hauser

Impacted products

18 products

Vendor	Product	Version
Endress+Hauser	MSC800	Affected: V1.0 , ≤ <=V4.25 (custom) Affected: S1.0 , ≤ <=S2.93.19 (custom)
Endress+Hauser	MARSIC200	Affected: all versions (custom)
Endress+Hauser	MARSIC280	Affected: all versions (custom)
Endress+Hauser	MARSIC300	Affected: all versions (custom)
Endress+Hauser	MCS100FT	Affected: all versions (custom)
Endress+Hauser	MCS200HW	Affected: all versions (custom)
Endress+Hauser	MCS300P	Affected: all versions (custom)
Endress+Hauser	MERCEM300Z	Affected: all versions (custom)
Endress+Hauser	SAM800	Affected: all versions (custom)
Endress+Hauser	SIPROCESS	Affected: all versions (custom)
Endress+Hauser	GMS800	Affected: all versions (custom)
Endress+Hauser	GMS800 FIDOR	Affected: all versions (custom)
Endress+Hauser	GM32	Affected: all versions (custom)
Endress+Hauser	VICOTEC320	Affected: all versions (custom)
Endress+Hauser	MCU ETH-Service and Modbus-TCP Module	Affected: all versions (custom)
Endress+Hauser	FLPS	Affected: all versions (custom)
Endress+Hauser	MES1B B&B Converter	Affected: all versions (custom)
sick	msc800_firmware	Affected: 1.0 , ≤ 4.25 (custom) Affected: 1.0 , ≤ s2.93.19 (custom) cpe:2.3:o:sick:msc800_firmware::::::::

Date Public

2024-09-12 21:33

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:sick:msc800_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "msc800_firmware",
            "vendor": "sick",
            "versions": [
              {
                "lessThanOrEqual": "4.25",
                "status": "affected",
                "version": "1.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "s2.93.19",
                "status": "affected",
                "version": "1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T13:53:13.856056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-13T14:02:19.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "MSC800",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=V4.25",
              "status": "affected",
              "version": "V1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "\u003c=S2.93.19",
              "status": "affected",
              "version": "S1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MARSIC200",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MARSIC280",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MARSIC300",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MCS100FT",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MCS200HW",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MCS300P",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MERCEM300Z",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAM800",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SIPROCESS",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "GMS800",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "GMS800 FIDOR",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "GM32",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "VICOTEC320",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MCU ETH-Service and Modbus-TCP Module",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "FLPS",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "MES1B B\u0026B Converter",
          "vendor": "Endress+Hauser",
          "versions": [
            {
              "status": "affected",
              "version": "all versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-12T21:33:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability allows a remote unauthenticated attacker to modify the prod\nuct\u2019s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.\u0026nbsp;\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability allows a remote unauthenticated attacker to modify the prod\nuct\u2019s IP address over the Sopas ET interface. This can lead to a Denial of Service attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T09:48:36.996Z",
        "orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
        "shortName": "SICK AG"
      },
      "references": [
        {
          "tags": [
            "x_SICK PSIRT Website"
          ],
          "url": "https://sick.com/psirt"
        },
        {
          "tags": [
            "x_SICK Operating Guidelines"
          ],
          "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
        },
        {
          "tags": [
            "x_ICS-CERT recommended practices on Industrial Security"
          ],
          "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
        },
        {
          "tags": [
            "x_CVSS v3.1 Calculator"
          ],
          "url": "https://www.first.org/cvss/calculator/3.1"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0002.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0009.pdf"
        },
        {
          "tags": [
            "x_The canonical URL"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0002.json"
        },
        {
          "tags": [
            "x_The canonical URL"
          ],
          "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0009.json"
        },
        {
          "tags": [
            "x_Endress+Hauser"
          ],
          "url": "https://www.endress.com"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "For Endress+Hauser MSC800FT: Customers who use the version \u0026lt;=V4.25 are strongly recommended to upgrade to the latest\nrelease V4.26\n\n\u003cbr\u003e"
            }
          ],
          "value": "For Endress+Hauser MSC800FT: Customers who use the version \u003c=V4.25 are strongly recommended to upgrade to the latest\nrelease V4.26"
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "For Endress+Hauser MSC800FT: Customers who use the version \u0026lt;=S2.93.19 are strongly recommended to upgrade to the\nlatest release S2.93.20.\n\n\u003cbr\u003e"
            }
          ],
          "value": "For Endress+Hauser MSC800FT: Customers who use the version \u003c=S2.93.19 are strongly recommended to upgrade to the\nlatest release S2.93.20."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-12T21:36:00.000Z",
          "value": "1: Initial version"
        },
        {
          "lang": "en",
          "time": "2026-07-16T10:00:00.000Z",
          "value": "2: Added more products"
        }
      ],
      "title": "CVE-2024-8751",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor Endress+Hauser\u0026nbsp;MARSIC200, MARSIC280, MARSIC300, MCS100FT, MCS200HW, MCS300P, MERCEM300Z, SAM800, SIPROCESS, GMS800, GMS800 FIDOR, GM32, VICOTEC320, MCU ETH-Service and Modbus-TCP Module, FLPS, MES1B B\u0026amp;B Converter:\u0026nbsp; Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices.\u003c/p\u003e"
            }
          ],
          "value": "For Endress+Hauser\u00a0MARSIC200, MARSIC280, MARSIC300, MCS100FT, MCS200HW, MCS300P, MERCEM300Z, SAM800, SIPROCESS, GMS800, GMS800 FIDOR, GM32, VICOTEC320, MCU ETH-Service and Modbus-TCP Module, FLPS, MES1B B\u0026B Converter:\u00a0 Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The \u201dICS-CERT recommended practices on Industrial Security\u201d could help to implement the general security practices."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
    "assignerShortName": "SICK AG",
    "cveId": "CVE-2024-8751",
    "datePublished": "2024-09-12T21:38:37.516Z",
    "dateReserved": "2024-09-12T13:17:03.176Z",
    "dateUpdated": "2026-07-16T09:48:36.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SCA-2026-0009

CVE-2024-8751 (GCVE-0-2024-8751)

Tags

Sightings

Nomenclature