CVE-2023-3272
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
CVE-2023-3272 vulnerability involves the transmission of sensitive information in cleartext in the SICK ICR890-4 device. A remote attacker could intercept network traffic, allowing access to confidential data.
Risk Assessment
The risk to the organization involves the potential leakage of sensitive information, which could lead to privacy breaches and possible financial losses.
Recommendation
It is recommended to implement encryption for transmitted data and to monitor network traffic for unauthorized access attempts.
Other vulnerabilities in SICK ICR890-4
See all- CVE-2023-3273High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings such as the IP address due to missing access control.
- CVE-2023-3271High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- CVE-2023-3270High
The vulnerability in SICK ICR890-4 allows an unauthorized remote attacker to access sensitive information about the system.
- CVE-2023-35699Medium
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
- CVE-2023-35698Medium
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- CVE-2023-35697Medium
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
- CVE-2023-35696High
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
Original NVD description (English source)
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.