CVE-2023-3270
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The vulnerability in SICK ICR890-4 allows an unauthorized remote attacker to access sensitive information about the system.
Risk Assessment
Exposure of sensitive data may lead to serious security breaches and loss of trust in the system.
Recommendation
It is recommended to implement appropriate security measures to restrict access to sensitive information and to monitor the system for unauthorized access attempts.
Other vulnerabilities in SICK ICR890-4
See all- CVE-2023-3273High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings such as the IP address due to missing access control.
- CVE-2023-3272High
CVE-2023-3272 vulnerability involves the transmission of sensitive information in cleartext in the SICK ICR890-4 device. A remote attacker could intercept network traffic, allowing access to confidential data.
- CVE-2023-3271High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- CVE-2023-35699Medium
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
- CVE-2023-35698Medium
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- CVE-2023-35697Medium
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
- CVE-2023-35696High
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.