High severity · published May 12, 2023
CVE-2023-23444
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832,…
8.2
CVSS
1.2%
EPSS
No
On KEV
Description
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fx0-gent00000 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gent00010 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gent00030 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gmod00000 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gmod00010 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gpnt00000 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gpnt00010 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gpnt00030 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en1 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en3 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en4 Firmware · Sick
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23444
Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.json
Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdf
Vendor Advisory
https://sick.com/psirt
More from Fx0-gent00000 Firmware
9.8
CVE-2023-23451
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW
9.8
CVE-2023-23453
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution…
8.8
CVE-2023-5246
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296,…
7.5
CVE-2019-14753
SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow