CVE-2023-23452 Missing authorization in FX0-GPNT v3 Firmware
Unauthenticated remote attackers can execute arbitrary code on SICK FX0-GPNT devices by sending malicious RK512 commands to TCP port 9000.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23452?
CVE-2023-23452 is a critical missing authorization vulnerability in FX0-GPNT v3 Firmware, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Weakness: CWE-306
Which versions are affected by CVE-2023-23452?
It affects 2 products.
Products include Sick Fx0-Gpnt00000 Firmware, Sick Fx0-Gpnt00010 Firmware.
How do I fix CVE-2023-23452?
No fix has been published for CVE-2023-23452 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-23452 being exploited?
There is no known exploitation of CVE-2023-23452 in the wild and no public exploit code.
Sources
Also known as GHSA-c93f-7869-prcf.