Modification of Assumed-Immutable Data in RDT400 by SICK
CVE-2023-43697

6.5MEDIUM

Key Information:

Vendor
Sick Ag
Status
Apu0200
Vendor
CVE Published:
9 October 2023

Summary

The RDT400 product by SICK exhibits a vulnerability that allows an unprivileged remote attacker to manipulate file paths through malicious HTTP requests. This modification can lead to the application failing to load essential data strings, disrupting its functionality and potentially exposing sensitive information. The lack of proper validation for assumed-immutable data may arise during user interactions, causing significant risks for data integrity and operational continuity.

Affected Version(s)

APU0200 all versions

References

https://sick.com/psirt
issue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-001...
vendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-001...
x_csaf

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-43697 : Modification of Assumed-Immutable Data in RDT400 by SICK | SecurityVulnerability.io