CVE-2023-4418 Denial of service in LMS5xx
Remote attackers can disrupt availability of SICK LMS5xx laser scanners via TCP SYN flood, impacting industrial operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4418?
CVE-2023-4418 is a high-severity denial of service vulnerability in SICK AG LMS5xx, published on 24 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP SYN requests, overwhelming its resources and causing it to become unresponsive or unavailable for legitimate users.
Weakness: CWE-400
Which versions are affected by CVE-2023-4418?
It affects 3 products.
Products include Sick Lms500 Firmware, Sick Lms511 Firmware, Sick Lms531 Firmware.
How do I fix CVE-2023-4418?
No fix has been published for CVE-2023-4418 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-4418 being exploited?
There is no known exploitation of CVE-2023-4418 in the wild and no public exploit code.
Other vulnerabilities in SICK AG LMS5xx
Sources
Also known as GHSA-xqcv-p45j-c72q.