Improper Access Control in SICK FTMg AIR FLOW SENSOR by SICK
CVE-2023-23445

7.5HIGH

Key Information:

Vendor

Sick Ag

Status
Sick Ftmg-esd15axx Air Flow Sensor
Sick Ftmg-esd20axx Air Flow Sensor
Sick Ftmg-esd25axx Air Flow Sensor
Sick Ftmg-esn40sxx Air Flow Sensor
Vendor
CVE Published:
15 May 2023

What is CVE-2023-23445?

The SICK FTMg AIR FLOW SENSOR is affected by a vulnerability that allows a remote attacker using an unprivileged account to gain unauthorized access to critical data fields through the REST interface. This improper access control may lead to significant information exposure, putting sensitive operations at risk. Users of affected models should review their security posture and apply necessary mitigations.

Affected Version(s)

SICK FTMG-ESD15AXX AIR FLOW SENSOR all firmware versions

SICK FTMG-ESD20AXX AIR FLOW SENSOR all firmware versions

SICK FTMG-ESD25AXX AIR FLOW SENSOR all firmware versions

References

https://sick.com/psirt
issue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-000...
vendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-000...
x_csaf

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-23445 : Improper Access Control in SICK FTMg AIR FLOW SENSOR by SICK