« Volver al listado

CVE-2024-10773

Estado: AplazadaCrítica (9)—

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N sin PR indica explotación remota (T1190). Credenciales hardcodeadas y pass-the-hash permiten autenticación como usuario oculto (T1078), manipulación de cuentas (T1098) y acceso completo del dispositivo (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementNetwork SegmentationMulti-factor AuthenticationApplication Isolation and SandboxingExploit Protection

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10773",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10773",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-09T14:37:48.545525Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@sick.de",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@sick.de",
      "affectedData": [
        {
          "vendor": "SICK AG",
          "product": "SICK InspectorP61x",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "<5.0.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SICK AG",
          "product": "SICK InspectorP62x",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "<5.0.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SICK AG",
          "product": "TiM3xx",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "<5.10.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:sick:inspector61x_firmware:-:*:*:*:*:*:*:*"
          ],
          "vendor": "sick",
          "product": "inspector61x_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.0.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:o:sick:inspector62x_firmware:-:*:*:*:*:*:*:*"
          ],
          "vendor": "sick",
          "product": "inspector62x_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.0.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:sick:tim3xx:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sick",
          "product": "tim3xx",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.10.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-06T13:15:05.897",
  "references": [
    {
      "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
      "source": "psirt@sick.de"
    },
    {
      "url": "https://sick.com/psirt",
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.first.org/cvss/calculator/3.1",
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
      "source": "psirt@sick.de"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@sick.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-912"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
    },
    {
      "lang": "es",
      "value": "El producto es vulnerable a ataques de tipo pass-the-hash en combinación con credenciales codificadas de niveles de usuario ocultos. Esto significa que un atacante puede iniciar sesión con los niveles de usuario ocultos y obtener acceso total al dispositivo."
    }
  ],
  "lastModified": "2026-06-17T06:56:24.717",
  "sourceIdentifier": "psirt@sick.de"
}