CVE-2023-23444 Missing authorization in FX0-GENT00000 FLEXISOFT EIP GATEW.

High 7.5 Published 12 May 2023 Updated 1 Jun 2026

Unauthenticated remote attackers can disrupt device availability by modifying IP settings via UDP packets on SICK Flexi gateways.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-23444?

CVE-2023-23444 is a high-severity missing authorization vulnerability in SICK AG FX0-GENT00000 FLEXISOFT EIP GATEW., published on 12 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.

Weakness: CWE-306

Which versions are affected by CVE-2023-23444?

It affects 11 products.

Products include Sick Fx0-Gent00000 Firmware, Sick Fx0-Gent00010 Firmware, Sick Fx0-Gent00030 Firmware, Sick Fx0-Gmod00000 Firmware, Sick Fx0-Gmod00010 Firmware, Sick Fx0-Gpnt00000 Firmware and 5 more.

How do I fix CVE-2023-23444?

No fix has been published for CVE-2023-23444 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-23444 being exploited?

There is no known exploitation of CVE-2023-23444 in the wild and no public exploit code.

Sources

Also known as GHSA-8w5h-774q-3rhm.