CVE-2024-10025

CRITICAL

SICK CLV6xx, Lector6xx, and RFx6xx - Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Description

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

References (6)

Core 6
Core References
Various Sources x_sick psirt webseite
https://sick.com/psirt
Third Party Advisory, US Government Resource x_ics-cert recommended practices on industrial security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Various Sources x_cvss v3.1 calculator
https://www.first.org/cvss/calculator/3.1

Scores

CVSS v3 9.1
EPSS 0.0072
EPSS Percentile 49.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-798
Status published
Products (3)
SICK AG/SICK CLV6xx all versions
SICK AG/SICK Lector6xx all versions
SICK AG/SICK RFx6xx all versions
Published Oct 17, 2024
Tracked Since Feb 18, 2026