CVE-2021-32496: sick visionary-s_cx_firmware Inadequate Encryption Strength

Vulnerability summary

CVE-2021-32496 is a medium (CVSS 5.3) Inadequate Encryption Strength vulnerability in sick visionary-s_cx_firmware. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.1% of scored vulnerabilities.

Timeline

1. 28-06-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.