CVE-2023-31412 Weak cryptography in LMS5xx
Weak hash generation in SICK LMS5xx allows attackers to potentially retrieve passwords via collision attacks if hashes are exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31412?
CVE-2023-31412 is a high-severity vulnerability in SICK AG LMS5xx, published on 24 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collision attacks and the potential retrieval of the password.
Weakness: CWE-916
Which versions are affected by CVE-2023-31412?
It affects 3 products.
Products include Sick Lms500 Firmware, Sick Lms511 Firmware, Sick Lms531 Firmware.
How do I fix CVE-2023-31412?
No fix has been published for CVE-2023-31412 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31412 being exploited?
There is no known exploitation of CVE-2023-31412 in the wild and no public exploit code.
Other vulnerabilities in SICK AG LMS5xx
Sources
Also known as GHSA-9pmh-r27r-8vx3.