CVE-2023-23450 : Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLO

Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via the REST interface.

Published 2023-05-15 11:15:09

Updated 2023-05-30 14:11:14

Source SICK AG

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-23450

Sick » Ftmg-esd20axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd20axx » Version: N/A
Sick » Ftmg-esd25axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd25axx » Version: N/A
Sick » Ftmg-esn40sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esn40sxx » Version: N/A
Sick » Ftmg-esn50sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esn50sxx » Version: N/A
Sick » Ftmg-esr50sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esr50sxx » Version: N/A
Sick » Ftmg-esr40sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esr40sxx » Version: N/A
Sick » Ftmg-esd15axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd15axx » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-23450

EPSS FAQ

0.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-23450

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	2.5	3.6	SICK AG
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-23450

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)
CWE-836 Use of Password Hash Instead of Password for Authentication

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

Assigned by: psirt@sick.de (Secondary)

References for CVE-2023-23450

https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf

Vendor Advisory

CVEs referencing this url
https://sick.com/psirt

The SICK Product Security Incident Response Team (SICK PSIRT) | SICK
Vendor Advisory

CVEs referencing this url
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-23450

Products affected by CVE-2023-23450

Exploit prediction scoring system (EPSS) score for CVE-2023-23450

CVSS scores for CVE-2023-23450

CWE ids for CVE-2023-23450

References for CVE-2023-23450