CVE-2023-35697 - OpenCVE

Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Sick	Icr890-4 Icr890-4 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf	Vendor Advisory
https://sick.com/psirt	Product

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: SICK AG

Published: 2023-07-10T09:35:52.067Z

Updated: 2023-07-10T09:35:52.067Z

Reserved: 2023-06-15T11:32:19.767Z

Link: CVE-2023-35697

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-07-10T16:15:52.877

Modified: 2023-07-17T19:01:32.377

Link: CVE-2023-35697

JSON object: View

Redhat Information

No data.

CWE

CWE-307

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-35697", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2023-06-15T11:32:19.767Z", "datePublished": "2023-07-10T09:35:52.067Z", "dateUpdated": "2023-07-10T09:35:52.067Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "ICR890-4", "vendor": "SICK AG", "versions": [{"lessThan": "2.5.0", "status": "affected", "version": "0", "versionType": "*"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": true, "type": "text/html", "value": "\n\nImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4\ncould allow a remote attacker to brute-force user credentials.\n\n"}], "value": "\nImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4\ncould allow a remote attacker to brute-force user credentials.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2023-07-10T09:35:52.067Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://sick.com/psirt"}, {"tags": ["vendor-advisory"], "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf"}, {"tags": ["x_csaf"], "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n<br>"}], "value": "\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n\n"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9781FA2-2446-4587-8BBA-1AC342BC5A0F", "versionEndExcluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*", "matchCriteriaId": "8E1AF1D7-8380-4B5C-8258-214F00638CC2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "\nImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4\ncould allow a remote attacker to brute-force user credentials.\n\n"}], "id": "CVE-2023-35697", "lastModified": "2023-07-17T19:01:32.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@sick.de", "type": "Secondary"}]}, "published": "2023-07-10T16:15:52.877", "references": [{"source": "psirt@sick.de", "tags": ["Vendor Advisory"], "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json"}, {"source": "psirt@sick.de", "tags": ["Vendor Advisory"], "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf"}, {"source": "psirt@sick.de", "tags": ["Product"], "url": "https://sick.com/psirt"}], "sourceIdentifier": "psirt@sick.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "psirt@sick.de", "type": "Secondary"}]}