Vulnerabilities in SICK MARSIC300
SICK received a report about multiple security vulnerabilities in the SICK MARSIC300 device. The security vulnerabilities are caused by the third-party library Dropbear, which is used by the SICK MARSIC300 to provide SSH communication. A successful exploitation of these vulnerabilities could lead to a remote code execution. SICK has released a new version of the SICK MARSIC300 firmware and recommends updating to the newest version.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-7407US | critical9.8 | — | ||
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file. | ||||
| CVE-2016-7406US | critical9.8 | — | ||
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument. | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- FixedSICK MARSIC300 with Firmware <1EU4_220310
SICK has released a new version of the SICK MARSIC300 firmware and recommends updating to the newest version.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan