Media Server vulnerabilities
6 known vulnerabilities in Media Server from SICK. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
SICK Media Server: Use of Insufficiently Random Values
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.
- 9.8 Critical severity
SICK Media Server: Improper Restriction of Excessive Authentication Attempts
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- 7.5 High severity
SICK Media Server: Cleartext Transmission of Sensitive Information
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.
- 7.5 High severity
SICK Media Server: Cleartext Transmission of Sensitive Information
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
- 9.8 Critical severity
SICK Media Server: Inclusion of Sensitive Information in Source Code
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
- 8.6 High severity
SICK Media Server: Missing Authorization
Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker could also send HTTP POST requests to modify the log files’ root path as well as the TCP ports the service is running on