CVE-2024-10771

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-10771", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2024-11-04T13:06:55.136Z", "datePublished": "2024-12-06T12:24:40.610Z", "dateUpdated": "2026-05-13T12:04:13.962Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-05-13T12:04:13.962Z"}, "title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution", "datePublic": "2024-12-06T12:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "SICK AG", "product": "SICK InspectorP61x", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "SICK InspectorP62x", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "TiM3xx", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "TDC-X401GL", "versions": [{"status": "affected", "version": "all versions"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."}]}], "references": [{"url": "https://sick.com/psirt", "tags": ["x_SICK PSIRT Website"]}, {"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF", "tags": ["x_SICK Operating Guidelines"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json", "tags": ["vendor-advisory", "x_csaf"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "For TiM3xx:\u00a0\n\nWe recommend updating the firmware only in a trusted environment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For TiM3xx:&nbsp;\n\nWe recommend updating the firmware only in a trusted environment."}]}, {"lang": "en", "value": "For\u00a0TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For&nbsp;TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability."}]}], "solutions": [{"lang": "en", "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."}]}], "credits": [{"lang": "en", "value": "Manuel Stotz", "type": "finder"}, {"lang": "en", "value": "Tobias Jaeger", "type": "finder"}], "source": {"advisory": "SCA-2024-0006", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "sick", "product": "inspector61x_firmware", "cpes": ["cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "5.0.0", "versionType": "custom"}]}, {"vendor": "sick", "product": "inspector62x_firmware", "cpes": ["cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "5.0.0", "versionType": "custom"}]}, {"vendor": "sick", "product": "tim3xx", "cpes": ["cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "5.10.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-09T14:46:19.943493Z", "id": "CVE-2024-10771", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T14:47:30.064Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10771", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-09T14:46:19.943493Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"], "vendor": "sick", "product": "inspector61x_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"], "vendor": "sick", "product": "inspector62x_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"], "vendor": "sick", "product": "tim3xx", "versions": [{"status": "affected", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T14:47:22.147Z"}}], "cna": {"title": "SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution", "source": {"advisory": "SCA-2024-0006", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Manuel Stotz"}, {"lang": "en", "type": "finder", "value": "Tobias Jaeger"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SICK AG", "product": "SICK InspectorP61x", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "SICK InspectorP62x", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "TiM3xx", "versions": [{"status": "affected", "version": "0", "lessThan": "<5.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "SICK AG", "product": "TDC-X401GL", "versions": [{"status": "affected", "version": "all versions"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release.", "supportingMedia": [{"type": "text/html", "value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release.", "base64": false}]}], "datePublic": "2024-12-06T12:00:00.000Z", "references": [{"url": "https://sick.com/psirt", "tags": ["x_SICK PSIRT Website"]}, {"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF", "tags": ["x_SICK Operating Guidelines"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json", "tags": ["vendor-advisory", "x_csaf"]}], "workarounds": [{"lang": "en", "value": "For TiM3xx:\u00a0\n\nWe recommend updating the firmware only in a trusted environment.", "supportingMedia": [{"type": "text/html", "value": "For TiM3xx:&nbsp;\n\nWe recommend updating the firmware only in a trusted environment.", "base64": false}]}, {"lang": "en", "value": "For\u00a0TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability.", "supportingMedia": [{"type": "text/html", "value": "For&nbsp;TDC-X401GL: Upon completion of the initial device setup, deactivate AppEngine. Disabling it fully mitigates\nthis vulnerability.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts.", "supportingMedia": [{"type": "text/html", "value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-05-13T12:04:13.962Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10771", "state": "PUBLISHED", "dateUpdated": "2026-05-13T12:04:13.962Z", "dateReserved": "2024-11-04T13:06:55.136Z", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "datePublished": "2024-12-06T12:24:40.610Z", "assignerShortName": "SICK AG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SICK InspectorP61x", "vendor": "SICK AG", "versions": [{"lessThan": "<5.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "SICK InspectorP62x", "vendor": "SICK AG", "versions": [{"lessThan": "<5.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "TiM3xx", "vendor": "SICK AG", "versions": [{"lessThan": "<5.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "TDC-X401GL", "vendor": "SICK AG", "versions": [{"status": "affected", "version": "all versions"}]}], "source": "psirt@sick.de"}, {"affectedData": [{"cpes": ["cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "inspector61x_firmware", "vendor": "sick", "versions": [{"lessThan": "5.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "inspector62x_firmware", "vendor": "sick", "versions": [{"lessThan": "5.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "tim3xx", "vendor": "sick", "versions": [{"lessThan": "5.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."}, {"lang": "es", "value": "Debido a la falta de validaci\u00f3n de entrada durante un paso del proceso de actualizaci\u00f3n del firmware, el producto es vulnerable a la ejecuci\u00f3n remota de c\u00f3digo. Con acceso a la red y el nivel de usuario \"Servicio\", un atacante puede ejecutar comandos arbitrarios del sistema en los contextos del usuario ra\u00edz."}], "id": "CVE-2024-10771", "lastModified": "2026-06-17T06:56:24.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "psirt@sick.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-10771", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-09T14:46:19.943493Z", "version": "2.0.3"}}]}, "published": "2024-12-06T13:15:04.797", "references": [{"source": "psirt@sick.de", "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"}, {"source": "psirt@sick.de", "url": "https://sick.com/psirt"}, {"source": "psirt@sick.de", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"source": "psirt@sick.de", "url": "https://www.first.org/cvss/calculator/3.1"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"}], "sourceIdentifier": "psirt@sick.de", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "psirt@sick.de", "type": "Secondary"}]}

{}

{}