What is the CVSS score of CVE-2022-27581?

CVE-2022-27581 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Rfu610 10600 Firmware CVE-2022-27581

MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2022-12-13 psirt@sick.de

Information Disclosure Rfu610 10600 Firmware Rfu610 10601 Firmware Rfu610 10603 Firmware Rfu610 10604 Firmware Rfu610 10605 Firmware Rfu610 10607 Firmware Rfu610 10609 Firmware Rfu610 10610 Firmware Rfu610 10613 Firmware Rfu610 10614 Firmware Rfu610 10618 Firmware Rfu610 10700 Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 13, 2022 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.

AnalysisAI

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-327. Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person. Affected products include: Sick Rfu610-10600 Firmware, Sick Rfu610-10601 Firmware, Sick Rfu610-10603 Firmware, Sick Rfu610-10604 Firmware, Sick Rfu610-10605 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.