SICK SSH Service Vulnerability in LMS1000 and MRS1000 Products Allowing Data Manipulation

A vulnerability exists in the SSH service of SICK LMS1000 and MRS1000 product families, all versions prior to 2.4.1. The issue arises from the use of outdated and weak Message Authentication Code (MAC) algorithms, which could allow an attacker with network access to compromise the integrity of SSH sessions. This vulnerability could lead to unauthorized manipulation of transmitted data, particularly if the attacker can interact with the network traffic.

Impact

Exploitation of this vulnerability could result in unauthorized manipulation of data within an SSH session, compromising the integrity of the communication.

Remediation

Users are strongly recommended to upgrade to version 2.4.1. For SICK LMS1000, this applies to all versions through 2.4.0, and for SICK MRS1000, all versions through 2.4.0.