Missing authentication in SICK AG MSC800
Priority MEDIUM 41CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00934 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SICK AG | MSC800 | V1.0 – <=V4.25; S1.0 – <=S2.93.19 | — | No fix listed | CNA |
| Endress+Hauser | MARSIC200 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MARSIC280 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MARSIC300 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MCS100FT | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MCS200HW | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MCS300P | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MERCEM300Z | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | SAM800 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | SIPROCESS | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | GMS800 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | GMS800 FIDOR | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | GM32 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | VICOTEC320 | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MCU ETH-Service and Modbus-TCP Module | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | FLPS | all versions and later | — | No fix listed | CNA |
| Endress+Hauser | MES1B B&B Converter | all versions and later | — | No fix listed | CNA |
- MSC800 VendorSICK AG Affected V1.0 – <=V4.25; S1.0 – <=S2.93.19 Fixed in — No fix listed CNA
- MARSIC200 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MARSIC280 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MARSIC300 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MCS100FT VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MCS200HW VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MCS300P VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MERCEM300Z VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- SAM800 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- SIPROCESS VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- GMS800 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- GMS800 FIDOR VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- GM32 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- VICOTEC320 VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MCU ETH-Service and Modbus-TCP Module VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- FLPS VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
- MES1B B&B Converter VendorEndress+Hauser Affected all versions and later Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8751
- 2026-10-03 Alias added: GHSA-m2jf-3295-7fpm
References
Advisory 2
Other 7
- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0002.json
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0009.json
- https://www.endress.com
More SICK AG vulnerabilities
- TI-2022-10578 Missing authentication in SICK SIM1004 CVSS 3.1CRITICAL 9.8
- TI-2022-10577 Missing authentication in SICK SIM1000 FX CVSS 3.1CRITICAL 9.8
- TI-2022-10576 Missing authentication in SICK SIM2000ST CVSS 3.1CRITICAL 9.8
- TI-2022-10574 Missing authentication in SICK SIM4000 CVSS 3.1CRITICAL 9.8
- TI-2026-01971 An attacker may perform unauthenticated read and write operations on sensitive filesystem… CVSS 3.1CRITICAL 9.8
- TI-2023-09295 Missing authentication in FX0-GENT v3 Firmware CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-8751 · CVE Program
- CVE-2024-8751 · NVD
- FIRST EPSS
- GHSA-m2jf-3295-7fpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences