CVE-2022-27577

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These forged packets could compromise services on the MSC800. SICK has released a new firmware version of the SICK MSC800 and recommends updating to the newest version.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-342 CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275787.8An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated o CVE-2022-275797.8A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and inc CVE-2022-27585.9Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Elec CVE-2022-275807.8A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including CVE-2022-275816.5Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt t CVE-2022-275829.8Password recovery vulnerability in SICK SIM4000 (PPC) Partnumber 1078787 allows an unprivileged remote attacker to gain access to the userle CVE-2022-275839.1A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected CVE-2022-275849.8Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel CVE-2022-275859.8Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remote CVE-2022-275869.8Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version <2.0.0 allows an unprivileged remote attacker to ga CVE-2022-275889.8We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later CVE-2022-27598.6Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software pr