QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-11075

Back to search

CVE-2024-11075

Published: Nov 19, 2024

Modified: Nov 19, 2024

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.

VendorProductVersions

SICK AG

SICK Incoming Goods Suite

affected
1.0.0

Weaknesses (CWE)

CWE-250

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://sick.com/psirt
x_SICK PSIRT Website
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
x_ICS-CERT recommended practices on Industrial Security

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now