CVE-2019-10979

highpriority · track · 40OT risk · elevatedEPSS 0.034 · 89 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
3.38% (89th) EPSS
CVSS 7.5 · high
Is it mine?
6 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-28

SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSICK MSC800 with Firmware <4.0sick_psirt

    SICK has released a firmware update for MSC800 and recommends updating to the new version V4.0. The update allows customers to change the default customer passwords and to optionally disable device configuration over desired networks interfaces, especially in critical infrastructures. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person. Until the firmware update is installed, general security practices should be utilized. In case the referenced patches cannot be applied, the following general security practices could mitigate the associated risk.

  • MitigationMSC800cisa_csaf_ot

    In case the referenced patches cannot be applied, the following general security practices could mitigate the associated risk.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · SICK PSIRT DE
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-798USprimaryCWE-798USCWE-798US
04

affected products (6)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SCA-2019-0001MSC800 affected by hard-coded credentials vulnerability2019-06-21csaf · sick_psirtDE

    The ICS-CERT reported a security vulnerability that affects MSC800 versions before 4.0. The MSC800 uses hard-coded credentials, which potentially allow low-skilled remote attackers to reconfigure settings and /or disrupt the functionality of the device. Currently SICK is not aware of any public exploits specifically targeting this vulnerability. SICK has released a firmware update for MSC800 and recommends updating to the new version.

  • ICSA-19-178-04SICK MSC8002019-06-27icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow a low-skilled remote attacker to reconfigure settings and/or disrupt the functionality of the device.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otnvdsick_psirtNVDCVE.orgMITRE
published 2019-07-01modified 2026-06-17
09

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan