SCA-2025-0012
Vulnerability from csaf_sick - Published: 2025-10-27 11:00 - Updated: 2025-10-27 14:00Summary
Sudo vulnerability affects SICK SID products
Notes
summary
SICK SID products are affected by the sudo vulnerability CVE-2025-32463. SICK strongly recommends to update to the latest version to mitigate the risk.
General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "SICK SID products are affected by the sudo vulnerability CVE-2025-32463. SICK strongly recommends to update to the latest version to mitigate the risk.",
"title": "summary"
},
{
"category": "general",
"text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
"title": "General Security Measures"
},
{
"category": "general",
"text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
"title": "Vulnerability Classification"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@sick.de",
"issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
"name": "SICK PSIRT",
"namespace": "https://www.sick.com/psirt"
},
"references": [
{
"summary": "SICK PSIRT Security Advisories",
"url": "https://sick.com/psirt"
},
{
"summary": "SICK Operating Guidelines",
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
},
{
"summary": "ICS-CERT recommended practices on Industrial Security",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"summary": "CVSS v3.1 Calculator",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"category": "self",
"summary": "The canonical URL.",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0012.json"
}
],
"title": "Sudo vulnerability affects SICK SID products",
"tracking": {
"current_release_date": "2025-10-27T14:00:00.000Z",
"generator": {
"date": "2025-10-20T07:08:17.386Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.37"
}
},
"id": "SCA-2025-0012",
"initial_release_date": "2025-10-27T11:00:00.000Z",
"revision_history": [
{
"date": "2025-10-27T14:00:00.000Z",
"number": "1",
"summary": "Initial version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK SID121 all versions",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SID121"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK SID121 LFT all versions",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SID121 LFT"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK SID71 all versions",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SID71"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICK SID71 LFT all versions",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SID71 LFT"
}
],
"category": "product_family",
"name": "Sensor Integration Display"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 4.2.7",
"product": {
"name": "SICK SID121 firmware \u003c 4.2.7",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "4.2.7",
"product": {
"name": "SICK SID121 firmware 4.2.7",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SID121 firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 4.2.7",
"product": {
"name": "SICK SID121 LFT firmware \u003c 4.2.7",
"product_id": "CSAFPID-0007"
}
},
{
"category": "product_version",
"name": "4.2.7",
"product": {
"name": "SICK SID121 LFT firmware 4.2.7",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "SID121 LFT firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 4.2.7",
"product": {
"name": "SICK SID71 firmware \u003c 4.2.7",
"product_id": "CSAFPID-0009"
}
},
{
"category": "product_version",
"name": "4.2.7",
"product": {
"name": "SICK SID71 firmware 4.2.7",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "SID71 firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 4.2.7",
"product": {
"name": "SICK SID71 LFT firmware \u003c 4.2.7",
"product_id": "CSAFPID-0011"
}
},
{
"category": "product_version",
"name": "4.2.7",
"product": {
"name": "SICK SID71 LFT firmware 4.2.7",
"product_id": "CSAFPID-0012"
}
}
],
"category": "product_name",
"name": "SID71 LFT firmware"
}
],
"category": "vendor",
"name": "SICK AG"
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID121 with Firmware \u003c 4.2.7",
"product_id": "CSAFPID-0013"
},
"product_reference": "CSAFPID-0005",
"relates_to_product_reference": "CSAFPID-0001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID121 LFT with Firmware \u003c 4.2.7",
"product_id": "CSAFPID-0014"
},
"product_reference": "CSAFPID-0007",
"relates_to_product_reference": "CSAFPID-0002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID71 with Firmware \u003c 4.2.7",
"product_id": "CSAFPID-0015"
},
"product_reference": "CSAFPID-0009",
"relates_to_product_reference": "CSAFPID-0003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID71 LFT with Firmware \u003c 4.2.7",
"product_id": "CSAFPID-0016"
},
"product_reference": "CSAFPID-0011",
"relates_to_product_reference": "CSAFPID-0004"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID121 all versions with Firmware 4.2.7",
"product_id": "CSAFPID-0017"
},
"product_reference": "CSAFPID-0006",
"relates_to_product_reference": "CSAFPID-0001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID121 LFT all versions with Firmware 4.2.7",
"product_id": "CSAFPID-0018"
},
"product_reference": "CSAFPID-0008",
"relates_to_product_reference": "CSAFPID-0002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID71 all versions with Firmware 4.2.7",
"product_id": "CSAFPID-0019"
},
"product_reference": "CSAFPID-0010",
"relates_to_product_reference": "CSAFPID-0003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "SICK SID71 LFT all versions with Firmware 4.2.7",
"product_id": "CSAFPID-0020"
},
"product_reference": "CSAFPID-0012",
"relates_to_product_reference": "CSAFPID-0004"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-32463",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"notes": [
{
"category": "summary",
"text": "Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.",
"title": "Summary"
}
],
"product_status": {
"fixed": [
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"known_affected": [
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
],
"recommended": [
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "It is strongly recommended to upgrade to the latest version (4.2.7)",
"product_ids": [
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.4,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 9.3,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
}
],
"title": "Sudo allows root access"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…