CVE-2023-23450

Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via the REST interface.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf	Vendor Advisory
https://sick.com/psirt	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-15 11:15

Updated : 2023-05-30 14:11

NVD link : CVE-2023-23450

Mitre link : CVE-2023-23450

CVE.ORG link : CVE-2023-23450

JSON object : View

Products Affected

sick

ftmg-esn40sxx
ftmg-esr50sxx_firmware
ftmg-esn40sxx_firmware
ftmg-esd25axx_firmware
ftmg-esd15axx
ftmg-esr40sxx_firmware
ftmg-esr50sxx
ftmg-esd20axx
ftmg-esn50sxx_firmware
ftmg-esn50sxx
ftmg-esr40sxx
ftmg-esd25axx
ftmg-esd15axx_firmware
ftmg-esd20axx_firmware

CWE

CWE-287

Improper Authentication

CWE-836

Use of Password Hash Instead of Password for Authentication

{"id": "CVE-2023-23450", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "published": "2023-05-15T11:15:09.407", "references": [{"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-836"}]}], "descriptions": [{"lang": "en", "value": "\nUse of Password Hash Instead of Password for Authentication in SICK FTMg AIR\nFLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526\nallows an unprivileged remote attacker to use a password hash instead of an actual password to login\nto a valid user account via the REST interface.\n\n"}], "lastModified": "2023-05-30T14:11:13.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3882685-8678-47E4-995C-C3F6D9AD5668", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16AD808F-900B-41EE-B90A-F9D67AAAD6BE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49D930E8-415C-4183-87A1-8D7F44247B67", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24618A95-328C-47C9-B8EF-B4DF6E65D68E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DCC9C0B-7CCE-44E5-B25D-67BF971B4541", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "290B016B-20B7-40C1-B825-6ED4774C4861"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E23D6018-1DFB-4516-82C9-3A3B09C2CBF9", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B113D9E-8E61-4F9C-9E5B-2030EEFB133B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77F2683F-B1B5-4033-97D4-ADF77B6B50E8", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A02547D3-5E40-41B3-A7B4-D63F60A5F80B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9075A02A-C627-43DA-ACF7-776197B518C5", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7B887993-18A8-493F-97A1-A788FBD5A5B9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9219CD8-34CE-45A2-904A-E7B1740706C2", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF162AA9-6645-4032-8D29-BAE2D60FBD9B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@sick.de"}