CVE-2023-23445

Summary

Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface.

Affected Software

VendorProductVersion RangeStatus
SICK AGSICK FTMG-ESD15AXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESD20AXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESD25AXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESN40SXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESN50SXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESR40SXX AIR FLOW SENSORall firmware versionsaffected
SICK AGSICK FTMG-ESR50SXX AIR FLOW SENSORall firmware versionsaffected

Weaknesses

  • CWE-284: CWE-284 Improper Access Control

Workarounds

Please make sure that you apply general security practices when operating the SICK FTMg like network segmentation. The following General Security Practices and Operating Guidelines could mitigate the associated security risk.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References