CVE-2025-0592
Published: 14 February 2025
Description
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.
Security Summary
CVE-2025-0592 is a vulnerability affecting SICK devices, where an attacker can manipulate a firmware file and upload it to the device, potentially allowing execution of arbitrary shell commands. Published on 2025-02-14, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-924.
A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables arbitrary shell command execution on the device, resulting in high impacts to confidentiality, integrity, and availability.
SICK has issued advisories via its PSIRT page, a special cybersecurity information document, and a CSAF provider in JSON format detailing the issue. Additional resources include CISA's ICS recommended practices and the FIRST CVSS calculator for score verification. Practitioners should consult these for mitigation guidance and patching instructions.
Details
- CWE(s)