{"id":"CVE-2024-10771","aliases":["EUVD-2024-33529","GHSA-252q-qph8-r7q3"],"status":"published","title":"SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution","description":"Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level ”Service”, an attacker\ncan execute arbitrary system commands in the root user’s contexts.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01105,"percentile":0.66054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2024-12-06T12:24:40Z","modified":"2026-06-17T06:56:24Z","products":[{"vendor":"sick","product":"inspector61x_firmware"},{"vendor":"sick","product":"inspector62x_firmware"},{"vendor":"sick","product":"tim3xx"},{"vendor":"sick ag","product":"sick inspectorp61x"},{"vendor":"sick ag","product":"sick inspectorp62x"},{"vendor":"sick ag","product":"tdc-x401gl"},{"vendor":"sick ag","product":"tim3xx"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Website"]},{"url":"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF","tags":["x_SICK Operating Guidelines"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator"]},{"url":"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf","tags":["vendor-advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json","tags":["vendor-advisory","x_csaf"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10771"},{"url":"https://github.com/advisories/GHSA-252q-qph8-r7q3"}],"sources":{"cve":[{"id":"CVE-2024-10771","title":"SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution","description":"Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level ”Service”, an attacker\ncan execute arbitrary system commands in the root user’s contexts.","status":"published","published":"2024-12-06T12:24:40.61Z","modified":"2026-05-13T12:04:13.962Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33529","description":"Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level ”Service”, an attacker\ncan execute arbitrary system commands in the root user’s contexts.","status":"published","published":"2024-12-06T12:24:40Z","modified":"2026-05-13T12:04:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-252q-qph8-r7q3","title":"Due to missing input validation during one step of the firmware update process, the product\nis...","description":"Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level ”Service”, an attacker\ncan execute arbitrary system commands in the root user’s contexts.","status":"published","published":"2024-12-06T15:31:19Z","modified":"2024-12-06T15:31:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:59:03.724628Z"}],"nvd":[{"id":"CVE-2024-10771","description":"Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level ”Service”, an attacker\ncan execute arbitrary system commands in the root user’s contexts.","status":"published","published":"2024-12-06T13:15:04.797Z","modified":"2026-06-17T06:56:24.457Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:39.434419Z"}]}}