Weak Password Hashing Vulnerability in SICK Devices
CVE-2025-27595

9.8CRITICAL

Key Information:

Vendor
Sick Ag
Status
Sick Dl100-2xxxxxxx
Vendor
CVE Published:
14 March 2025

Summary

The SICK devices utilize a weak hashing algorithm for creating password hashes, which can be exploited by attackers to easily deduce matching passwords. This vulnerability undermines the overall security framework and integrity of the device, potentially allowing unauthorized access and control.

Affected Version(s)

SICK DL100-2xxxxxxx all versions

References

https://sick.com/psirt
x_SICK PSIRT Website
https://cdn.sick.com/media/docs/1/11/411/Special_informat...
x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recomm...
x_ICS-CERT recommended practices on Industrial Security

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leonard Lewedei
.