CVE-2023-23453 Missing authorization in FX0-GENT v3 Firmware
Unauthenticated remote attackers can execute arbitrary code on SICK FX0-GENT devices by sending malicious RK512 commands to TCP port 9000.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23453?
CVE-2023-23453 is a critical missing authorization vulnerability in FX0-GENT v3 Firmware, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Weakness: CWE-306
Which versions are affected by CVE-2023-23453?
It affects 2 products.
Products include Sick Fx0-Gent00000 Firmware, Sick Fx0-Gent00010 Firmware.
How do I fix CVE-2023-23453?
No fix has been published for CVE-2023-23453 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-23453 being exploited?
There is no known exploitation of CVE-2023-23453 in the wild and no public exploit code.
Other vulnerabilities in FX0-GENT v3 Firmware
- CVE-2023-23451 Hardcoded credentials in SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000, SICK FX0-GMOD00010, SICK FX0-GPNT00000, SICK FX0-GPNT00030, SICK UE410-EN1, SICK UE410-EN3, SICK UE410-EN3S04, SICK UE410-EN4
- CVE-2023-5246 Auth bypass in FX0-GENT00000
- CVE-2023-23444 Missing authorization in FX0-GENT00000 FLEXISOFT EIP GATEW.
- CVE-2019-14753 Memory corruption in n/a
Sources
Also known as GHSA-r2fh-99j3-j6mx.