CVE-2023-4419

CRITICAL

SICK LMS5xx Firmware - Use of Hard-coded Credentials

Title source: llm

Description

The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.

References (3)

Core 3

Core References

Vendor Advisory issue-tracking

https://sick.com/psirt

Vendor Advisory vendor-advisory

https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf

Vendor Advisory x_csaf

https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json

Scores

CVSS v3 9.8

EPSS 0.0069

EPSS Percentile 48.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-798

Status published

Products (4)

sick/lms500_firmware

sick/lms511_firmware

sick/lms531_firmware

SICK AG/LMS5xx < V2.21

Published Aug 24, 2023

Tracked Since Feb 18, 2026