by Kastro
Paper/Archive/CVE-2023-23450

CVE-2023-23450

SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR — Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via the REST interface.

Affected

ProductAffectedFixed inSource
SICK FTMG-ESD15AXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESD20AXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESD25AXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESN40SXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESN50SXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESR40SXX AIR FLOW SENSORall firmware versions–CNA
SICK FTMG-ESR50SXX AIR FLOW SENSORall firmware versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SICK AG (CNA)6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsick.com/psirtadvisorysick.com/.well-known/csaf/white/2023/sca-2023-0004.pdfrefsick.com/.well-known/csaf/white/2023/sca-2023-0004.json