CVE-2025-27594

14 Mar 2025

Título es
CVE-2025-27594

Vie, 14/03/2025 – 13:15

Tipo
CWE-319

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-27594

Descripción en
The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack.

14/03/2025

Vector CVSS:3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Gravedad 3.1 (CVSS 3.1 Base Score)
7.50

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
HIGH

Referencias

https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF

https://github.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html

https://sick.com/psirt

https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

https://www.first.org/cvss/calculator/3.1

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.json

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf