What’s Vulnerable › Vulnerabilities

CVE-2024-11075: SICK Incoming Goods Suite privilege escalation vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-19 · updated 2026-06-17
• Weakness: CWE-250

Description

A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.

Affected products

• SICK AG Incoming Goods Suite: 1.0.0

References

• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
• https://sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.json
• https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0005.pdf

Get alerted when CVE-2024-11075 or the next vulnerability affects your stack