CVE-2019-10979
highPriorität · verfolgen · 40OT-Risiko · erhöhtEPSS 0.034 · 89. PerzentilDEEUUSEPSS · bewertet 2026-10-28
SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSICK MSC800 with Firmware <4.0sick_psirt
SICK has released a firmware update for MSC800 and recommends updating to the new version V4.0. The update allows customers to change the default customer passwords and to optionally disable device configuration over desired networks interfaces, especially in critical infrastructures. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person. Until the firmware update is installed, general security practices should be utilized. In case the referenced patches cannot be applied, the following general security practices could mitigate the associated risk.
- MitigationMSC800cisa_csaf_ot
In case the referenced patches cannot be applied, the following general security practices could mitigate the associated risk.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SCA-2019-0001MSC800 affected by hard-coded credentials vulnerability2019-06-21csaf · sick_psirtDE
The ICS-CERT reported a security vulnerability that affects MSC800 versions before 4.0. The MSC800 uses hard-coded credentials, which potentially allow low-skilled remote attackers to reconfigure settings and /or disrupt the functionality of the device. Currently SICK is not aware of any public exploits specifically targeting this vulnerability. SICK has released a firmware update for MSC800 and recommends updating to the new version.
- ICSA-19-178-04SICK MSC8002019-06-27icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow a low-skilled remote attacker to reconfigure settings and/or disrupt the functionality of the device.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2019-10979cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.2349/cnnvd
- https://www.securityfocus.com/bid/108924cnnvd
- https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisoriescnnvd
- https://www.sick.com/us/encnnvd
- https://www.us-cert.gov/ics/advisories/icsa-19-178-04cnnvd
- http://www.securityfocus.com/bid/108924enisa_euvd
- https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisoriesenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan