SICK picoScan and multiScan Denial-of-Service Vulnerability via Slowloris Attack

A denial-of-service vulnerability has been identified in SICK picoScan and multiScan products, all versions. This vulnerability allows remote attackers to conduct a Slowloris-type attack, causing the web page to become unresponsive. The issue arises from the architectural design of these products, which can be exploited by manipulating how the web server handles incoming requests.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the web page to become unresponsive.

Remediation

To mitigate this vulnerability, ensure that only trusted entities have access to the device. SICK also recommends following general security practices to operate the product in a protected IT environment. The web server can be disabled via the CyberSecurity page in the user interface.