Vulnerability · Published Aug 24, 2023 · Assigned by SICK AG
CVE-2023-4420
Critical 9.8
In plain English
A critical-severity security flaw in LMS5xx from SICK AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.
Affected products (as reported)
References
- https://sick.com/psirt issue-tracking
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf vendor-advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json x_csaf