Critical severity · published Apr 19, 2023
CVE-2023-23451
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fx0-gent00000 Firmware · Sick
through 2.11.0 · source: NVD
FF
Fx0-gent00030 Firmware · Sick
All versions, or not specified · source: NVD
FF
Fx0-gmod00000 Firmware · Sick
through 2.11.0 · source: NVD
FF
Fx0-gmod00010 Firmware · Sick
through 2.11.0 · source: NVD
FF
Fx0-gpnt00000 Firmware · Sick
through 2.12.0 · source: NVD
FF
Fx0-gpnt00030 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en1 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en3 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en3s04 Firmware · Sick
All versions, or not specified · source: NVD
UF
Ue410-en4 Firmware · Sick
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23451
Vendor Advisory
https://sick.com/psirt
More from Fx0-gent00000 Firmware
9.8
CVE-2023-23453
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution…
8.8
CVE-2023-5246
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296,…
8.2
CVE-2023-23444
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832,…
7.5
CVE-2019-14753
SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow