CVE-2023-23444

moderate-risk

Published 2023-05-12

Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.

Do I need to act?

0.84% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (11)

Ue410-En4 Firmware

Ue410-En3 Firmware

Ue410-En1 Firmware

Fx0-Gpnt00030 Firmware

Fx0-Gpnt00010 Firmware

Fx0-Gpnt00000 Firmware

Fx0-Gmod00010 Firmware

Fx0-Gmod00000 Firmware

Fx0-Gent00030 Firmware

Fx0-Gent00010 Firmware

Fx0-Gent00000 Firmware

Affected Vendors

Sick

References (6)

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.json

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdf

Vendor Advisory https://sick.com/psirt

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.json

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0003.pdf

Vendor Advisory https://sick.com/psirt

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 16/34 · Moderate