CVE-2023-3273

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf	Vendor Advisory
https://sick.com/psirt	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-07-10 16:15

Updated : 2023-07-19 16:24

NVD link : CVE-2023-3273

Mitre link : CVE-2023-3273

CVE.ORG link : CVE-2023-3273

JSON object : View

Products Affected

sick

icr890-4_firmware
icr890-4

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2023-3273", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-07-10T16:15:55.560", "references": [{"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Product"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP\naddress based on missing access control.\n\n\n"}], "lastModified": "2023-07-19T16:24:40.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9781FA2-2446-4587-8BBA-1AC342BC5A0F", "versionEndExcluding": "2.5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8E1AF1D7-8380-4B5C-8258-214F00638CC2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@sick.de"}