CVE-2023-3271
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
Risk Assessment
The organization may be exposed to data leakage and unauthorized access to system information, which could lead to serious security consequences.
Recommendation
It is recommended to implement appropriate access control mechanisms and security measures for API endpoints to prevent unauthorized user access.
Other vulnerabilities in SICK ICR890-4
See all- CVE-2023-3273High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings such as the IP address due to missing access control.
- CVE-2023-3272High
CVE-2023-3272 vulnerability involves the transmission of sensitive information in cleartext in the SICK ICR890-4 device. A remote attacker could intercept network traffic, allowing access to confidential data.
- CVE-2023-3270High
The vulnerability in SICK ICR890-4 allows an unauthorized remote attacker to access sensitive information about the system.
- CVE-2023-35699Medium
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
- CVE-2023-35698Medium
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- CVE-2023-35697Medium
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
- CVE-2023-35696High
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
Original NVD description (English source)
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.