CVE-2025-0592
Published: 14 February 2025
Summary
CVE-2025-0592 is a high-severity Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CWE-924) vulnerability in Sick (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Verifies the integrity of firmware uploads to detect and prevent execution of manipulated firmware containing arbitrary shell commands.
Requires digital signatures on firmware components, rejecting tampered files that could enable arbitrary command execution.
Validates uploaded firmware files against expected formats and content to block manipulated inputs leading to shell command execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Firmware upload manipulation on network-exposed device enables remote exploitation of public app (T1190) leading directly to arbitrary Unix shell command execution (T1059.004).
NVD Description
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.
Deeper analysisAI
CVE-2025-0592 is a vulnerability affecting SICK devices, where an attacker can manipulate a firmware file and upload it to the device, potentially allowing execution of arbitrary shell commands. Published on 2025-02-14, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-924.
A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables arbitrary shell command execution on the device, resulting in high impacts to confidentiality, integrity, and availability.
SICK has issued advisories via its PSIRT page, a special cybersecurity information document, and a CSAF provider in JSON format detailing the issue. Additional resources include CISA's ICS recommended practices and the FIRST CVSS calculator for score verification. Practitioners should consult these for mitigation guidance and patching instructions.
Details
- CWE(s)