Search/CVE-2022-27577
● CVE — Critical

CVE-2022-27577

VendorsickProductmsc800 firmwareDiscoveredApr 11, 2022UpdatedNov 21, 2024

The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These forged packets could compromise services on the MSC800. SICK has released a new firmware version of the SICK MSC800 and recommends updating to the newest version.

CVSS v3.1
9.1 CRITICAL
EPSS
1.44%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 1, 2026
▲ 0.02pp
1.41% → 1.44% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
Apr 11, 2022
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024