Lucene search

SICK AGCVELIST:CVE-2023-3271

HistoryJul 10, 2023 - 9:26 a.m.

CVE-2023-3271

2023-07-1009:26:21

CWE-284

SICK AG

www.cve.org

access control

sick icr890-4

unauthenticated

remote attacker

information gathering

data download

rest api

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.0%

JSON

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing
unauthenticated endpoints.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "ICR890-4",
    "vendor": "SICK AG",
    "versions": [
      {
        "lessThan": "2.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "*"
      }
    ]
  }
]

References

sick.com/.well-known/csaf/white/2023/sca-2023-0006.json

sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf

sick.com/psirt

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.0%

JSON

Related for CVELIST:CVE-2023-3271