CVE-2023-35696
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
Risk Assessment
An attacker could gain access to sensitive device data, potentially leading to further attacks or system compromise.
Recommendation
It is recommended to secure the endpoints and implement authentication for access to sensitive information.
Other vulnerabilities in SICK ICR890-4
See all- CVE-2023-3273High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings such as the IP address due to missing access control.
- CVE-2023-3272High
CVE-2023-3272 vulnerability involves the transmission of sensitive information in cleartext in the SICK ICR890-4 device. A remote attacker could intercept network traffic, allowing access to confidential data.
- CVE-2023-3271High
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- CVE-2023-3270High
The vulnerability in SICK ICR890-4 allows an unauthorized remote attacker to access sensitive information about the system.
- CVE-2023-35699Medium
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
- CVE-2023-35698Medium
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- CVE-2023-35697Medium
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
Original NVD description (English source)
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.