CVE-2024-10025: SICK Products Plain Text Password Vulnerability

CVE-2024-10025 Overview

A vulnerability in SICK industrial products allows attackers to read default passwords stored in plain text within .sdd configuration files. By exploiting these plaintext credentials, an attacker can authenticate to affected SICK products as an "Authorized Client" if the customer has not changed the default password. This hardcoded credentials vulnerability (CWE-798) represents a significant security risk in industrial control system (ICS) environments where SICK products are deployed.

Critical Impact

Attackers with network access can extract hardcoded default credentials from configuration files to gain unauthorized "Authorized Client" access to SICK industrial products, potentially compromising industrial control systems.

Affected Products

• SICK Industrial Products utilizing .sdd configuration files
• Products with default password configurations
• Industrial control systems running unpatched SICK firmware

Discovery Timeline

• October 17, 2024 - CVE-2024-10025 published to NVD
• October 18, 2024 - Last updated in NVD database

Technical Details for CVE-2024-10025

Vulnerability Analysis

This vulnerability stems from insecure credential storage practices in SICK industrial products. The .sdd file format used by these products contains default passwords stored in plaintext, making them trivially accessible to anyone who can retrieve the configuration file. Once an attacker obtains these credentials, they can authenticate as an "Authorized Client" to any affected device where the default password has not been changed.

The attack can be executed remotely over the network without requiring any prior authentication or user interaction. This makes the vulnerability particularly dangerous in industrial environments where network segmentation may be insufficient, allowing attackers to move laterally and compromise critical operational technology (OT) systems.

Root Cause

The root cause of CVE-2024-10025 is the use of hardcoded credentials (CWE-798) within the product's configuration files. Default passwords are embedded in plaintext within .sdd files, which can be accessed and read by attackers. This design flaw violates fundamental secure coding principles by:

• Storing sensitive authentication credentials in plaintext format
• Using static default passwords that are identical across product deployments
• Failing to enforce password change requirements during initial setup

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with network access to the target SICK device can exploit this vulnerability through the following process:

1. Obtain access to the .sdd configuration file through network reconnaissance or file extraction
2. Parse the configuration file to extract plaintext default credentials
3. Use the extracted credentials to authenticate as an "Authorized Client"
4. Gain unauthorized access to device configuration and operational controls

The vulnerability requires no authentication, no user interaction, and presents low attack complexity, making it highly exploitable in environments where default credentials have not been changed.

Detection Methods for CVE-2024-10025

Indicators of Compromise

• Unexpected authentication attempts to SICK devices using default credentials
• Anomalous network traffic patterns targeting SICK product management interfaces
• Configuration file access or extraction attempts from industrial network segments
• Login events from unrecognized source IP addresses to SICK devices

Detection Strategies

• Monitor authentication logs on SICK devices for successful logins using default account names
• Implement network traffic analysis to detect credential extraction or unauthorized access attempts
• Deploy file integrity monitoring to detect unauthorized access to .sdd configuration files
• Use industrial intrusion detection systems (IDS) to monitor for known attack patterns

Monitoring Recommendations

• Establish baseline network behavior for SICK devices and alert on deviations
• Configure SIEM rules to correlate authentication events across industrial control systems
• Implement logging of all administrative and configuration access to SICK products
• Review access logs regularly for unauthorized "Authorized Client" sessions

How to Mitigate CVE-2024-10025

Immediate Actions Required

• Change all default passwords on SICK products immediately
• Audit all deployed SICK devices to identify those using default credentials
• Implement network segmentation to isolate industrial control systems from untrusted networks
• Apply principle of least privilege for user accounts accessing SICK devices

Patch Information

Organizations should consult the SICK PSIRT Resource Page for the latest security advisories and firmware updates. Additional technical details are available in the SICK CSAF Security Advisory (PDF). SICK has also published cybersecurity guidance documentation with recommendations for securing their products.

For general ICS security guidance, refer to CISA ICS Recommended Practices.

Workarounds

• Immediately change all default passwords to strong, unique credentials on each device
• Implement network access controls to restrict management interface access to authorized IP addresses
• Enable authentication logging and monitoring where supported
• Consider deploying a jump server or bastion host for administrative access to industrial devices

# Configuration example: Network segmentation using firewall rules
# Block external access to SICK device management ports
# Replace [SICK_DEVICE_IP] and [MANAGEMENT_PORT] with actual values

# Allow only authorized management workstations
iptables -A INPUT -s [AUTHORIZED_MGMT_IP] -d [SICK_DEVICE_IP] -p tcp --dport [MANAGEMENT_PORT] -j ACCEPT

# Deny all other access to management interfaces
iptables -A INPUT -d [SICK_DEVICE_IP] -p tcp --dport [MANAGEMENT_PORT] -j DROP