CVE-2024-10771
HIGHSICK InspectorP61x/InspectorP62x/TiM3xx - Remote Code Execution
Title source: llmDescription
Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.
References (6)
Core 6
Core References
Various Sources x_sick psirt website
https://sick.com/psirt
Various Sources x_sick operating guidelines
https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
Third Party Advisory, US Government Resource x_ics-cert recommended practices on industrial security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Various Sources x_cvss v3.1 calculator
https://www.first.org/cvss/calculator/3.1
Various Sources vendor-advisory
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf
Various Sources vendor-advisory
x_csaf
https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
Scores
CVSS v3
8.8
EPSS
0.0107
EPSS Percentile
60.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (4)
SICK AG/SICK InspectorP61x
< <5.0.0
SICK AG/SICK InspectorP62x
< <5.0.0
SICK AG/TDC-X401GL
all versions
SICK AG/TiM3xx
< <5.10.0
Published
Dec 06, 2024
Tracked Since
Feb 18, 2026