CVE-2024-10776

HIGH

SICK InspectorP61x and InspectorP62x < 5.0.0 - Unauthenticated Arbitrary Lua App Deployment via AppManager

Title source: llm
STIX 2.1

Description

Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer.

References (6)

Core 6
Core References
Various Sources x_sick psirt website
https://sick.com/psirt
Various Sources x_cvss v3.1 calculator
https://www.first.org/cvss/calculator/3.1
Third Party Advisory, US Government Resource x_ics-cert recommended practices on industrial security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Scores

CVSS v3 8.2
EPSS 0.0047
EPSS Percentile 37.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
SICK AG/SICK InspectorP61x < <5.0.0
SICK AG/SICK InspectorP62x < <5.0.0
Published Dec 06, 2024
Tracked Since Feb 18, 2026