What’s Vulnerable › Vulnerabilities

CVE-2024-10025: Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-17 · updated 2026-06-17
• Weakness: CWE-798

Description

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

Affected products

• SICK Lector611 Firmware: all versions

References

• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
• https://sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json
• https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf

Get alerted when CVE-2024-10025 or the next vulnerability affects your stack