CVE-2022-27583 Missing authorization in SICK FlexiCompact
Remote unprivileged attackers can access the configuration interface of SICK FlexiCompact PLCs to cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27583?
CVE-2022-27583 is a critical missing authorization vulnerability in SICK FlexiCompact, published on 31 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version to potentially impact the availability of the FlexiCompact.
Weakness: CWE-285
Which versions are affected by CVE-2022-27583?
It affects 2 products.
Products include Sick Flx3-Cpuc1 Firmware, Sick Flx3-Cpuc2 Firmware.
How do I fix CVE-2022-27583?
No fix has been published for CVE-2022-27583 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-27583 being exploited?
There is no known exploitation of CVE-2022-27583 in the wild and no public exploit code.
Sources
Also known as GHSA-jw59-9v6j-fpwh.