CVE-2023-4420
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
CVE-2023-4420 allows a remote unprivileged attacker to intercept communication with SICK LMS5xx devices due to the absence of TLS security. This can lead to unauthorized disclosure of sensitive information and data manipulation.
Risk Assessment
The lack of encryption in the communication channel poses a risk of confidential data exposure and modification by an attacker. The organization may lose customer trust and face legal consequences.
Recommendation
It is recommended to implement Transport Layer Security (TLS) in communication with SICK LMS5xx devices to secure transmitted data against interception and manipulation.
Original NVD description (English source)
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.