description:
A remote unauthorized attacker may connect to the SIM1012, interact with the device and
change configuration settings. The adversary may also reset the SIM and in the worst case upload a
new firmware version to the device.
problem types: CWE-284 Improper Access Control
affected:
{
defaultStatus: affected
product: SIM1012
vendor: SICK AG
versions:
status: affected, version: all versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
SICK recommends to disable port 2111 & 2122 once the SIM1012 is put into operation. The
information how to disable the port can be retrieved from the SIM1012 API documentation. SICK
recommends using the SICK AppManager in version >=1.5.6 for the commissioning of the SIM1012.