CVE-2023-23444
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS
- 1.17% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- sick/ue410-en4 firmware · sick/ue410-en3 firmware · sick/ue410-en1 firmware · sick/fx0-gpnt00030 firmware · sick/fx0-gpnt00010 firmware · sick/fx0-gpnt00000 firmware · sick/fx0-gmod00010 firmware · sick/fx0-gmod00000 firmware · sick/fx0-gent00030 firmware · sick/fx0-gent00010 firmware · sick/fx0-gent00000 firmware
- Source
- psirt@sick.de
References
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.jsonVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdfVendor Advisory
- https://sick.com/psirtVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.jsonVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdfVendor Advisory
- https://sick.com/psirtVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.