SCA-2024-0001

csafDEsick_psirt

Vulnerability in SICK Logistics Analytics Products and SICK Field Analytics

Advisory ansehen veröffentlicht 2024-01-29

A critical vulnerability in Apache ActiveMQ affects the SICK products Field Analytics 1.2 and Logistics Analytics products 4.5. The Java OpenWire protocol marshaller that is used in ActiveMQ Classic and ActiveMQ Artemis is vulnerable to Remote Code execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Therefore it is strongly recommended to upgrade both Logistics Analytics products 4.5 and Field Analytics 1.2 to the latest release. Prior versions of Logistics Analytics products are not affected.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2023-46604UScritical9.8OT kritischKEV
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire b…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (5)

  • BehobenBaggage Analytics

    Customers who use the version 4.5 are strongly recommended to upgrade to the latest release 4.5.1. Prior versions of Logistics Analytics products are not affected.

  • BehobenField Analytics

    Customers who use the version 1.2 are strongly recommended to upgrade to the latest release 1.2.2.

  • BehobenLogistics Diagnostic Analytics

    Customers who use the version 4.5 are strongly recommended to upgrade to the latest release 4.5.1. Prior versions of Logistics Analytics products are not affected.

  • BehobenPackage Analytics

    Customers who use the version 4.5 are strongly recommended to upgrade to the latest release 4.5.1. Prior versions of Logistics Analytics products are not affected.

  • BehobenTire Analytics

    Customers who use the version 4.5 are strongly recommended to upgrade to the latest release 4.5.1. Prior versions of Logistics Analytics products are not affected.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan