CVE-2019-10979: SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password

Critical severity · published Jul 1, 2019

CVE-2019-10979

SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password

9.8

CVSS

3.4%

EPSS

On KEV

Description

SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.4% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Msc800 Firmware · Sick

before 4.0 · source: NVD

Affected product

Msc800 Firmware

Sick

All Msc800 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-10979

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-10979

Third Party Advisory

http://www.securityfocus.com/bid/108924

www.sick.com

https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories

Third Party Advisory

https://www.us-cert.gov/ics/advisories/icsa-19-178-04