CVE-2021-32496 Weak cryptography in SICK Visionary-S CX
Weak SSH ciphers in SICK Visionary-S CX allow attackers to compromise encryption, exposing sensitive data and enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32496?
CVE-2021-32496 is a medium-severity vulnerability in SICK Visionary-S CX, published on 28 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.
Weakness: CWE-326
Which versions are affected by CVE-2021-32496?
It affects 1 product.
Products include Sick Visionary-S Cx Firmware.
How do I fix CVE-2021-32496?
No fix has been published for CVE-2021-32496 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32496 being exploited?
There is no known exploitation of CVE-2021-32496 in the wild and no public exploit code.
Sources
Also known as GHSA-r3cp-34p4-q2x9.