CVE-2023-5246

high-risk
Published 2023-10-23

Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availability, integrity and confidentiality of the gateways via an authentication bypass by capture-replay.

Do I need to act?

~
1.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (13)

Fx0-Gent00000 Firmware
Fx0-Gent00010 Firmware
Fx0-Gent00030 Firmware
Fx0-Get00000 Firmware
Fx0-Get00010 Firmware
Fx0-Gmod00000 Firmware
Fx0-Gmod00010 Firmware
Fx0-Gmod00030 Firmware
Fx0-Gpnt00000 Firmware
Fx0-Gpnt00010 Firmware
Fx0-Gpnt00030 Firmware
Fx0-Gepr00000 Firmware
Fx0-Gepr00010 Firmware

Affected Vendors

Sick

References (6)

Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.json
Mitigation https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf
Vendor Advisory https://sick.com/psirt
Vendor Advisory https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.json
Mitigation https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf
Vendor Advisory https://sick.com/psirt
51
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 4/34 · Minimal
Exposure 17/34 · Moderate