SICK Flexi Compact Unauthenticated IP Address Change Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the SICK Flexi Compact series, specifically in the FLX0-GPNT100 and FLX3-CPUC200 models, all firmware versions. This vulnerability allows a remote, unauthenticated attacker to change the device's IP address, potentially disrupting the device's availability.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition by causing the device to become unavailable due to an unauthorized change of its IP address.

Remediation

It is recommended to ensure that only trusted entities have access to the device. Additionally, SICK advises following general security practices to minimize network exposure and restrict access, which can be guided by the SICK Operating Guidelines and ICS-CERT recommended practices on Industrial Security.