CVE-2023-5246
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availability, integrity and confidentiality of the gateways via an authentication bypass by capture-replay.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- sick/fx0-gent00000 firmware · sick/fx0-gent00010 firmware · sick/fx0-gent00030 firmware · sick/fx0-get00000 firmware · sick/fx0-get00010 firmware · sick/fx0-gmod00000 firmware · sick/fx0-gmod00010 firmware · sick/fx0-gmod00030 firmware · sick/fx0-gpnt00000 firmware · sick/fx0-gpnt00010 firmware · sick/fx0-gpnt00030 firmware · sick/fx0-gepr00000 firmware · sick/fx0-gepr00010 firmware
- Source
- psirt@sick.de
References
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.jsonVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdfMitigation, Vendor Advisory
- https://sick.com/psirtVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.jsonVendor Advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdfMitigation, Vendor Advisory
- https://sick.com/psirtVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.