CVE-2020-2075
Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.44% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-703, CWE-755
- Affected
- sick/lms111 firmware · sick/lms511 firmware · sick/clv620 firmware · sick/clv622 firmware · sick/clv621 firmware · sick/icr890-3 firmware · sick/msc800 firmware · sick/rfh firmware · sick/clv650 firmware · sick/clv651 firmware · sick/clv631 firmware · sick/clv630 firmware · sick/clv632 firmware · sick/clv640 firmware · sick/clv642 firmware · sick/lms100 firmware · sick/lms101 firmware · sick/lms153 firmware · sick/lms151 firmware · sick/lms133 firmware · +10 more
- Source
- psirt@sick.de
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.