CVEvulnerability
CVE-2024-10771
8.8 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2024-12-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Due to missing input validation during one step of the firmware update process, the product
is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker
can execute arbitrary system commands in the root user’s contexts.
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF cdn.sick.com
- https://sick.com/psirt sick.com
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices www.cisa.gov
- https://www.first.org/cvss/calculator/3.1 www.first.org
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json www.sick.com
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf www.sick.com