Critical severity · published May 15, 2023
CVE-2023-23450
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR
FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526
allows an unprivileged remote attacker to use a password hash instead of an actual password to login
to a valid user account via the REST interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Ftmg-esd15axx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esd20axx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esd25axx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esn40sxx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esn50sxx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esr40sxx Firmware · Sick
before 2.0 · source: NVD
FF
Ftmg-esr50sxx Firmware · Sick
before 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23450
Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json
Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf
Vendor Advisory
https://sick.com/psirt
More from Ftmg-esd15axx Firmware
7.5
CVE-2023-31409
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to…
7.5
CVE-2023-31408
Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to…
7.5
CVE-2023-23447
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote…
7.5
CVE-2023-23446
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to…
7.5
CVE-2023-23445
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain…