CVE-2023-3273
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings such as the IP address due to missing access control.
Risk Assessment
The organization may experience disruptions in device operation, potentially leading to downtime in operational processes.
Recommendation
It is recommended to implement appropriate access control mechanisms and regularly update the device firmware to protect against unauthorized access.
Other vulnerabilities in SICK ICR890-4
See all- CVE-2023-3272High
CVE-2023-3272 vulnerability involves the transmission of sensitive information in cleartext in the SICK ICR890-4 device. A remote attacker could intercept network traffic, allowing access to confidential data.
- CVE-2023-3271High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- CVE-2023-3270High
The vulnerability in SICK ICR890-4 allows an unauthorized remote attacker to access sensitive information about the system.
- CVE-2023-35699Medium
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
- CVE-2023-35698Medium
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- CVE-2023-35697Medium
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
- CVE-2023-35696High
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
Original NVD description (English source)
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.