{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "audience": "all",
        "category": "summary",
        "text": "WIBU publicly released an advisory for the WIBU product “CodeMeter Runtime Network Server”. The advisory discloses a buffer over-read vulnerability that was found in the WIBU product “CodeMeter Runtime Network Server”. \n\nBy default the network server functionality is disabled, however the SICK product “FieldEcho” may be vulnerable, if customers enables this.\nSICK has released a new FieldEcho version and recommends updating to the newest version.\n\nSince version 1.5.2 of SICK “FieldEcho”, customer can choose to use their own license server. If so, SICK advises to take action in accordance with the official WIBU Security Advisory.\n"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "http://ics-cert.us-cert.gov/content/recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2022/sca-2022-0001.json"
      }
    ],
    "title": "Vulnerability in SICK FieldEcho",
    "tracking": {
      "current_release_date": "2022-02-17T16:00:00.000Z",
      "generator": {
        "date": "2023-02-10T08:19:04.679Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.0.0"
        }
      },
      "id": "SCA-2022-0001",
      "initial_release_date": "2022-02-17T16:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-02-17T16:00:00.000Z",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2023-02-10T11:00:00.000Z",
          "number": "2",
          "summary": "Updated Advisory (only visual changes)"
        },
        {
          "number": "3",
          "date": "2025-07-30T07:29:45.000Z",
          "summary": "Updated Advisory: URL for SICK Operating Guidelines has been updated"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.5.3",
                "product": {
                  "name": "SICK FieldEcho <1.5.3",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "skus": [
                      "1612993"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "SICK:Website",
                        "uri": "SICK:Website:https://www.sick.com/de/de/p/p597264"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "1.5.3",
                "product": {
                  "name": "SICK FieldEcho 1.5.3",
                  "product_id": "CSAFPID-0002",
                  "product_identification_helper": {
                    "skus": [
                      "1612993"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FieldEcho"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20093",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2021-06-15T15:00:00.000Z",
      "notes": [
        {
          "category": "description",
          "text": "An attacker could send a specially crafted packet that could have the CodeMeter Runtime Network Server send back packets containing data from the heap or crash the server."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "Security Advisory from WIBU",
          "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-17T16:00:00.000Z",
          "details": "Update to latest version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sick.com/de/de/sick-integrationspace/software-for-integration/fieldecho/fieldechoc2ae/p/p597264"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Buffer Over-Read Attack"
    }
  ]
}