Tloc100 100 Firmware
Monthly
Remote unauthenticated denial of service in the SICK TLOC100-100 industrial device firmware, where a file transfer submitted with a chunk-size value that does not match the actual payload triggers a deadlock (CWE-833) that blocks the transfer and prevents subsequent transfers from completing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is purely an availability impact - no confidentiality, integrity, or code-execution effect - and because the device is remote-reachable with no authentication or user interaction required, any attacker who can reach the file-transfer function on a reachable network segment can stall it. Risk is moderate in practice: no public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.41% (33rd percentile), with the main limiting factor being that these are specialized industrial devices normally deployed on segmented OT/ICS networks rather than the public internet. Note that the 'Information Disclosure' tag attached to this record contradicts the CVSS vector (C:N) and the CWE-833 deadlock root cause, and should be disregarded.
Denial of service in the SICK TLOC100-100 firmware allows remote attackers who can interact with the UpdateService using a tampered C++ CLI client to crash the service during file transfers, disrupting update availability. The flaw is an uncaught exception (CWE-248) that triggers under timing- and feature-specific conditions when malformed client input is processed mid-transfer. No public exploit code or active exploitation has been identified, and EPSS is low at 0.55%; the high CVSS score of 7.5 reflects a worst-case availability impact but real-world risk is moderated by the need to reach and drive the update interface.
The unauthenticated C++ API exposed by SICK TLOC100-100 localization devices performs no authorization checks, letting any remote, unauthenticated attacker who can reach the interface read or modify sensitive data and disrupt device services, yielding a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for full confidentiality, integrity and availability impact. All firmware versions matching cpe:2.3:o:sick:tloc100-100_firmware:* are in scope according to the vendor's PSIRT advisory (SCA-2025-0013). Exploitation is not confirmed active (no CISA KEV listing) and no public exploit identified at time of analysis; EPSS is a modest 0.49% (40th percentile), which is consistent with the practical constraint that TLOC100 units normally sit on segmented OT/plant networks rather than internet-facing infrastructure.
Denial of service in SICK TLoc100-100 firmware allows an attacker who obtains SSH access to an unprivileged account to exhaust system resources, disrupting services including SSH itself and causing a persistent outage that may require manual recovery. Although the published CVSS vector indicates no privileges required (PR:N), our assessment confirms that valid SSH credentials for a non-root user are a prerequisite; it is not anonymously exploitable. No public exploit identified at time of analysis, and the EPSS score is low (0.34%, 26th percentile).
Remote unauthenticated denial of service in the SICK TLOC100-100 industrial device firmware, where a file transfer submitted with a chunk-size value that does not match the actual payload triggers a deadlock (CWE-833) that blocks the transfer and prevents subsequent transfers from completing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is purely an availability impact - no confidentiality, integrity, or code-execution effect - and because the device is remote-reachable with no authentication or user interaction required, any attacker who can reach the file-transfer function on a reachable network segment can stall it. Risk is moderate in practice: no public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.41% (33rd percentile), with the main limiting factor being that these are specialized industrial devices normally deployed on segmented OT/ICS networks rather than the public internet. Note that the 'Information Disclosure' tag attached to this record contradicts the CVSS vector (C:N) and the CWE-833 deadlock root cause, and should be disregarded.
Denial of service in the SICK TLOC100-100 firmware allows remote attackers who can interact with the UpdateService using a tampered C++ CLI client to crash the service during file transfers, disrupting update availability. The flaw is an uncaught exception (CWE-248) that triggers under timing- and feature-specific conditions when malformed client input is processed mid-transfer. No public exploit code or active exploitation has been identified, and EPSS is low at 0.55%; the high CVSS score of 7.5 reflects a worst-case availability impact but real-world risk is moderated by the need to reach and drive the update interface.
The unauthenticated C++ API exposed by SICK TLOC100-100 localization devices performs no authorization checks, letting any remote, unauthenticated attacker who can reach the interface read or modify sensitive data and disrupt device services, yielding a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for full confidentiality, integrity and availability impact. All firmware versions matching cpe:2.3:o:sick:tloc100-100_firmware:* are in scope according to the vendor's PSIRT advisory (SCA-2025-0013). Exploitation is not confirmed active (no CISA KEV listing) and no public exploit identified at time of analysis; EPSS is a modest 0.49% (40th percentile), which is consistent with the practical constraint that TLOC100 units normally sit on segmented OT/plant networks rather than internet-facing infrastructure.
Denial of service in SICK TLoc100-100 firmware allows an attacker who obtains SSH access to an unprivileged account to exhaust system resources, disrupting services including SSH itself and causing a persistent outage that may require manual recovery. Although the published CVSS vector indicates no privileges required (PR:N), our assessment confirms that valid SSH credentials for a non-root user are a prerequisite; it is not anonymously exploitable. No public exploit identified at time of analysis, and the EPSS score is low (0.34%, 26th percentile).