CVE-2023-31409

Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf	Vendor Advisory
https://sick.com/psirt	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-15 11:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-31409

Mitre link : CVE-2023-31409

CVE.ORG link : CVE-2023-31409

JSON object : View

Products Affected

sick

ftmg-esd15axx
ftmg-esd25axx
ftmg-esr50sxx
ftmg-esr40sxx
ftmg-esn40sxx
ftmg-esr50sxx_firmware
ftmg-esd20axx_firmware
ftmg-esn50sxx_firmware
ftmg-esn50sxx
ftmg-esd15axx_firmware
ftmg-esd20axx
ftmg-esd25axx_firmware
ftmg-esr40sxx_firmware
ftmg-esn40sxx_firmware

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-31409", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-05-15T11:15:09.550", "references": [{"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "\nUncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.\n\n"}], "lastModified": "2023-05-25T14:21:13.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3882685-8678-47E4-995C-C3F6D9AD5668", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd20axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16AD808F-900B-41EE-B90A-F9D67AAAD6BE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49D930E8-415C-4183-87A1-8D7F44247B67", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd25axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24618A95-328C-47C9-B8EF-B4DF6E65D68E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DCC9C0B-7CCE-44E5-B25D-67BF971B4541", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "290B016B-20B7-40C1-B825-6ED4774C4861"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E23D6018-1DFB-4516-82C9-3A3B09C2CBF9", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esn50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B113D9E-8E61-4F9C-9E5B-2030EEFB133B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77F2683F-B1B5-4033-97D4-ADF77B6B50E8", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr50sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A02547D3-5E40-41B3-A7B4-D63F60A5F80B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9075A02A-C627-43DA-ACF7-776197B518C5", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esr40sxx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7B887993-18A8-493F-97A1-A788FBD5A5B9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9219CD8-34CE-45A2-904A-E7B1740706C2", "versionEndExcluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:ftmg-esd15axx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF162AA9-6645-4032-8D29-BAE2D60FBD9B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@sick.de"}