CVE-2023-35699

low-risk

Published 2023-07-10

Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

PHYSICAL / LOW complexity

Affected Products (1)

Icr890-4 Firmware

Affected Vendors

Sick

References (6)

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf

Product https://sick.com/psirt

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf

Product https://sick.com/psirt

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal