CVE-2023-23447

Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing several open file requests via the REST interface.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf	Vendor Advisory
https://sick.com/psirt	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-15 11:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-23447

Mitre link : CVE-2023-23447

CVE.ORG link : CVE-2023-23447

JSON object : View

Products Affected

sick

ftmg-esd15axx
ftmg-esd25axx
ftmg-esr50sxx
ftmg-esr40sxx
ftmg-esn40sxx
ftmg-esr50sxx_firmware
ftmg-esd20axx_firmware
ftmg-esn50sxx_firmware
ftmg-esn50sxx
ftmg-esd15axx_firmware
ftmg-esd20axx
ftmg-esd25axx_firmware
ftmg-esr40sxx_firmware
ftmg-esn40sxx_firmware

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-23447", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-05-15T11:15:09.217", "references": [{"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "\nUncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged\nremote attacker to influence the availability of the webserver by invocing several open file requests via\nthe REST interface.\n\n"}], "lastModified": "2023-05-25T13:17:58.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3882685-8678-47E4-995C-C3F6D9AD5668", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16AD808F-900B-41EE-B90A-F9D67AAAD6BE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49D930E8-415C-4183-87A1-8D7F44247B67", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24618A95-328C-47C9-B8EF-B4DF6E65D68E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DCC9C0B-7CCE-44E5-B25D-67BF971B4541", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "290B016B-20B7-40C1-B825-6ED4774C4861"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E23D6018-1DFB-4516-82C9-3A3B09C2CBF9", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B113D9E-8E61-4F9C-9E5B-2030EEFB133B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77F2683F-B1B5-4033-97D4-ADF77B6B50E8", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A02547D3-5E40-41B3-A7B4-D63F60A5F80B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9075A02A-C627-43DA-ACF7-776197B518C5", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7B887993-18A8-493F-97A1-A788FBD5A5B9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9219CD8-34CE-45A2-904A-E7B1740706C2", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF162AA9-6645-4032-8D29-BAE2D60FBD9B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@sick.de"}