Sick MSC800 Firmware vulnerabilities

4 CVEs affecting Sick MSC800 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-8751, published 2024-09-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10979, published 2019-07-01. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
CVE-2020-2075, published 2020-08-31. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x,…
CVE-2022-27577, published 2022-04-11. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that…
CVE-2024-8751, published 2024-09-12. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.