Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0566 State: PUBLISHED Published: 2025-01-19T06:31:12.505Z Last Updated: 2025-01-21T15:07:57.295Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC15 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292527 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292527 - https://vuldb.com/?ctiid.292527 - https://vuldb.com/?submit.484418 - https://pan.baidu.com/s/1DBDf27oCTIMkW-PSZwg02Q?pwd=tara - https://www.tenda.com.cn/
CVE ID: CVE-2025-0567 State: PUBLISHED Published: 2025-01-19T07:31:04.454Z Last Updated: 2025-01-21T15:06:58.966Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Epic Games Products: Launcher Problem Types: CWE-426 Description: A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
xploitation appears to be difficult. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292528 - https://vuldb.com/?ctiid.292528 - https://vuldb.com/?submit.481104
CVE ID: CVE-2025-0568 State: PUBLISHED Published: 2025-01-30T20:16:57.248Z Last Updated: 2025-01-31T19:05:32.012Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-119 Description: Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory
of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25302. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-049/
CVE ID: CVE-2025-0569 State: PUBLISHED Published: 2025-01-30T20:17:11.644Z Last Updated: 2025-02-10T22:08:31.384Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-119 Description: Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory
of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25303. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-052/
CVE ID: CVE-2025-0570 State: PUBLISHED Published: 2025-01-30T20:17:01.728Z Last Updated: 2025-01-31T18:58:02.814Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-119 Description: Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in
e parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25304. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-050/
CVE ID: CVE-2025-0571 State: PUBLISHED Published: 2025-01-30T20:17:06.424Z Last Updated: 2025-02-10T22:08:38.831Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-119 Description: Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in
e parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25305. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-051/
CVE ID: CVE-2025-0572 State: PUBLISHED Published: 2025-01-30T20:17:21.650Z Last Updated: 2025-02-10T22:08:18.560Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Sante Products: PACS Server Problem Types: CWE-22 Description: Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file ope
of DCM files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of the current user. Was ZDI-CAN-25308. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-054/
CVE ID: CVE-2025-0573 State: PUBLISHED Published: 2025-01-30T20:17:16.438Z Last Updated: 2025-02-10T22:08:24.901Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Sante Products: PACS Server Problem Types: CWE-22 Description: Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations
files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of the current user. Was ZDI-CAN-25309. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-053/
CVE ID: CVE-2025-0574 State: PUBLISHED Published: 2025-01-30T20:17:27.460Z Last Updated: 2025-01-30T20:39:29.549Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-119 Description: Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of URLs in the web server module. The issue results from the lack of proper validation of user-supplied data, which can result
in the web server module. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25318. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-055/
CVE ID: CVE-2025-0575 State: PUBLISHED Published: 2025-01-19T23:00:11.533Z Last Updated: 2025-01-21T15:04:02.407Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Union Bank of India Products: Vyom Problem Types: CWE-693 Description: A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the component Rooting Detection. The manipulation leads to protection mechanism failure. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The v
ther high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292540 - https://vuldb.com/?ctiid.292540 - https://vuldb.com/?submit.475733 - https://drive.google.com/file/d/1kIXsZoD1FFps0bXQ1pbrfoo76Wy1pL7s/view?usp=drivesdk
CVE ID: CVE-2025-0576 State: PUBLISHED Published: 2025-01-19T23:31:04.005Z Last Updated: 2025-01-21T20:26:46.919Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Mobotix Products: M15 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&eventlist&pda&dummy_for_reload=1736177631&p_evt. The manipulation of the argument p_qual leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way
losed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292541 - https://vuldb.com/?ctiid.292541 - https://vuldb.com/?submit.475602
CVE ID: CVE-2025-0578 State: PUBLISHED Published: 2025-01-20T01:00:16.388Z Last Updated: 2025-01-21T20:23:44.175Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Facile Sistemas Products: Cloud Apps Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disc
k remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292596 - https://vuldb.com/?ctiid.292596 - https://vuldb.com/?submit.476305
CVE ID: CVE-2025-0579 State: PUBLISHED Published: 2025-01-20T02:31:04.543Z Last Updated: 2025-02-12T20:41:20.302Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: Shiprocket Module Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ea
tack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292597 - https://vuldb.com/?ctiid.292597 - https://vuldb.com/?submit.476831 - https://gist.github.com/mcdruid/3c9fc9bd4e882cee21f8a37998f56fce
CVE ID: CVE-2025-0580 State: PUBLISHED Published: 2025-01-20T02:31:05.900Z Last Updated: 2025-01-21T20:23:23.261Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Shiprocket Module Problem Types: CWE-863, CWE-285 Description: A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/rest_api&action=getOrders of the component REST API Module. The manipulation of the argument contentHash leads to incorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitatio
ncorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292598 - https://vuldb.com/?ctiid.292598 - https://vuldb.com/?submit.476832 - https://gist.github.com/mcdruid/0d1fdbba445587639ee5da66e7abfcc9
CVE ID: CVE-2025-0581 State: PUBLISHED Published: 2025-01-20T03:00:11.375Z Last Updated: 2025-01-21T20:16:36.025Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CampCodes Products: School Management Software Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292599 - https://vuldb.com/?ctiid.292599 - https://vuldb.com/?submit.484895 - https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20Stored%20Cross%20Site%20Scripting-%20Account%20Takeover%20Possibility.pdf - https://www.campcodes.com/
CVE ID: CVE-2025-0582 State: PUBLISHED Published: 2025-01-20T03:00:16.147Z Last Updated: 2025-01-21T20:13:50.728Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: itsourcecode Products: Farm Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig.php. The manipulation of the argument pigphoto leads to unrestricted upload. The attack can be initiated remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292600 - https://vuldb.com/?ctiid.292600 - https://vuldb.com/?submit.484
lnrichment: References: - https://vuldb.com/?id.292600 - https://vuldb.com/?ctiid.292600 - https://vuldb.com/?submit.484909 - https://github.com/yunhai666/cve/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2025-0583 State: PUBLISHED Published: 2025-01-20T01:51:47.137Z Last Updated: 2025-02-12T20:41:20.728Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: aEnrich Technology Products: a+HRD Problem Types: CWE-79 Description: The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8368-1e317-1.html - https://www.twcert.org.tw/en/cp-139-8369-cf396-2.html
CVE ID: CVE-2025-0584 State: PUBLISHED Published: 2025-01-20T02:06:19.718Z Last Updated: 2025-01-21T14:43:40.739Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: aEnrich Technology Products: a+HRD Problem Types: CWE-918 Description: The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8370-58eb5-1.html - https://www.twcert.org.tw/en/cp-139-8371-1c17a-2.html
CVE ID: CVE-2025-0585 State: PUBLISHED Published: 2025-01-20T02:17:29.155Z Last Updated: 2025-01-21T14:39:00.962Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Technology Products: a+HRD Problem Types: CWE-89 Description: The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8372-19721-1.html - https://www.twcert.org.tw/en/cp-139-8373-91edc-2.html
CVE ID: CVE-2025-0586 State: PUBLISHED Published: 2025-01-20T02:28:02.503Z Last Updated: 2025-02-12T20:41:20.485Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Technology Products: a+HRD Problem Types: CWE-502 Description: The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8374-7085a-1.html - https://www.twcert.org.tw/en/cp-139-8375-59abd-2.html
CVE ID: CVE-2025-0587 State: PUBLISHED Published: 2025-03-04T03:44:22.237Z Last Updated: 2025-03-04T14:33:49.389Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-190 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can be exploited only in restricted scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-0588 State: PUBLISHED Published: 2025-02-11T11:22:27.034Z Last Updated: 2025-03-13T15:30:38.062Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Denial of Service with Backdoor access Description: In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens cou
and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2024/sa2025-05/
CVE ID: CVE-2025-0589 State: PUBLISHED Published: 2025-02-11T08:59:51.030Z Last Updated: 2025-02-11T15:20:52.205Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Active Directory data can be read using API endpoints without Authentication Description: In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group
ific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2025/sa2025-01/
CVE ID: CVE-2025-0590 State: PUBLISHED Published: 2025-01-20T06:22:44.117Z Last Updated: 2025-03-24T17:37:24.242Z Vendors: TECNO Products: com.transsion.carlcare Problem Types: CWE-732 Description: Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/381?lang=en_US - https://security.tecno.com/SRC/securityUpdates
CVE ID: CVE-2025-0591 State: PUBLISHED Published: 2025-02-16T23:58:32.165Z Last Updated: 2025-02-18T16:06:14.940Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: OMRON Corporation Products: FA Integrated Tool Package CX-One Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf
CVE ID: CVE-2025-0592 State: PUBLISHED Published: 2025-02-14T20:16:03.352Z Last Updated: 2025-02-14T22:01:00.488Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: SICK Lector8xx, SICK InspectorP8xx Problem Types: CWE-924 Description: The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-pr
l_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.json