CVE-2020-2075

mediumpriority · track · 31EPSS 0.014 · 73 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.44% (73rd) EPSS

CVSS 5 · medium

Is it mine?

66 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · sick_psirt

EPSS · scored 2026-10-28

Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSICK Bulkscan LMS111 with Firmware <1.04sick_psirt
Update to version V1.04 SICK removed the AutoIP weakness with the same available fix for the MSC800. The update can only be implemented by a SICK service technician, either by remote access or on site. To obtain the update, please contact your local service technician.
FixedSICK Bulkscan LMS511 with Firmware <2.3sick_psirt
Update to version V2.30 SICK removed the AutoIP weakness with the same available fix for the MSC800. The update can only be implemented by a SICK service technician, either by remote access or on site. To obtain the update, please contact your local service technician.
FixedSICK LMS10x with Firmware <2.0sick_psirt
Update to version V2.0 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK LMS11x with Firmware <2.0sick_psirt
Update to version V2.0 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK LMS12x with Firmware <2.1sick_psirt
Update to version V2.10 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK LMS13x with Firmware <2.1sick_psirt
Update to version V2.10 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK LMS14x with Firmware <2.1sick_psirt
Update to version V2.10 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK LMS15x with Firmware <2.0sick_psirt
Update to version V2.0 The update fixes, that the LMS1xx series does not reboot anymore, after it received an incorrect payload on the AutoIP port. There are no known limitations. The update to version V2.0 respectively V2.10 will be available from mid-October 2020 on. To get the latest LMS1xx firmware update, please contact the responsible SICK Sales and Service unit, or download it from sick.com.
FixedSICK MSC800 with Firmware <4.1sick_psirt
Update to version V4.1 The update fixes that the MSC800 does not reboot anymore after it received an incorrect payload on the AutoIP port. There are no known limitations. To get the latest MSC800 firmware update please contact the responsible SICK Sales and Service unit. They can support if there is the need to consider any customer specific changes or constraints related to legal for trade systems.
WorkaroundSICK CLV62x with Firmware <=6.10sick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK CLV63x with Firmware <=6.10sick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK CLV64x with Firmware <=6.10sick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK CLV65x with Firmware <=6.10sick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK ICR890-3 all Firmware versionssick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK LMS53x all Firmware versionssick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK LMS5xx all Firmware versionssick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.
WorkaroundSICK RFH all Firmware versionssick_psirt
Restrict or block access to UDP port 30718 for the affected products. This workaround reduces the risk of the exploitation of the vulnerability but also limits the AutoIP function.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SICK PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-755USprimaryCWE-703US

affected products (66)

Products and version ranges known to be affected.

n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFH≤ All versions with Ethernet interfaceenisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFH≤ All ICR890-3 and ICR890-3.5 devices all versionsenisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFH≤ All versionsenisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFHAll Versions → V1.04enisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFHAll Versions → V2.0enisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFHAll Versions → V2.10enisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFHAll Versions → V2.30enisa_euvdEU
n/a Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFHAll Versions → V4.10enisa_euvdEU
sick clv620 firmwareall versionsnvdUScpe:2.3:o:sick:clv620_firmware:*:*:*:*:*:*:*:*
sick clv621 firmwareall versionsnvdUScpe:2.3:o:sick:clv621_firmware:*:*:*:*:*:*:*:*
sick clv622 firmwareall versionsnvdUScpe:2.3:o:sick:clv622_firmware:*:*:*:*:*:*:*:*
sick clv630 firmwareall versionsnvdUScpe:2.3:o:sick:clv630_firmware:*:*:*:*:*:*:*:*
sick clv631 firmwareall versionsnvdUScpe:2.3:o:sick:clv631_firmware:*:*:*:*:*:*:*:*
sick clv632 firmwareall versionsnvdUScpe:2.3:o:sick:clv632_firmware:*:*:*:*:*:*:*:*
sick clv640 firmwareall versionsnvdUScpe:2.3:o:sick:clv640_firmware:*:*:*:*:*:*:*:*
sick clv642 firmwareall versionsnvdUScpe:2.3:o:sick:clv642_firmware:*:*:*:*:*:*:*:*
sick clv650 firmwareall versionsnvdUScpe:2.3:o:sick:clv650_firmware:*:*:*:*:*:*:*:*
sick clv651 firmwareall versionsnvdUScpe:2.3:o:sick:clv651_firmware:*:*:*:*:*:*:*:*
sick icr890-3 firmwareall versionsnvdUScpe:2.3:o:sick:icr890-3_firmware:*:*:*:*:*:*:*:*
sick icr890-3.5 firmwareall versionsnvdUScpe:2.3:o:sick:icr890-3.5_firmware:*:*:*:*:*:*:*:*

showing 20 of 66

advisories (1)

Vendor and ecosystem advisories describing this.

SCA-2020-0004Vulnerability in Platform Mechanism AutoIP2020-08-31csaf · sick_psirtDE
SICK received a report from IOActive that informed SICK about a security vulnerability within the platform mechanism AutoIP, used by multiple devices. SICK recommends updating to the newest version. Refer to the recommended remediations for affected products where no update is available. Currently SICK is not aware of any public exploits specifically targeting this vulnerability.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd sick_psirt NVD CVE.org MITRE

published 2020-08-31modified 2026-06-17

related (707)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-109619US	high8.1OT critical	100.0% (100th)	KEV	2026-10-21
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The g…
CVE-2026-109618US	critical9.8OT critical	100.0% (100th)	KEV	2026-10-21
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave…
CVE-2024-29748US	high7.8OT critical	0.68% (52nd)	KEV	2024-04-05
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2022-22265US	high7.8OT critical	0.39% (33rd)	KEV	2022-01-10
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2021-38003US	high8.8OT critical	38.6% (99th)	KEV	2021-11-23
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

+702 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan