CVE-2022-27586

CVE-2022-27586 is a critical password recovery vulnerability affecting SICK SIM1004 Partnumber 1098148 devices with firmware versions prior to 2.0.0. An unprivileged remote attacker can exploit this flaw to invoke the password recovery mechanism, gaining elevated privileges up to the "RecoverableUserLevel." This significantly impacts the confidentiality, integrity, and availability of the affected system. The vulnerability carries a CVSS score of 9.8 (Critical), indicating it is easily exploitable over the network with low attack complexity and no user interaction required, leading to complete compromise. While the EPSS score is low, suggesting a lower probability of exploitation compared to most CVEs, the FAUCET Risk Score of 79/100 highlights its significant potential impact. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal. The recommended mitigation is to immediately update the firmware to version 2.0.0 or higher.