Skip to content
OpenAdvisories
High SCA-2023-0006 8 CVEs

Vulnerabilities in SICK ICR890-4

Published Jul 10, 2023 · Updated Jul 10, 2023 · Revision 3

Vendor: SICK Product: ICR890-4 Product: ICR890-4 Firmware

Summary

SICK has found several security vulnerabilities in the SICK ICR890-4. If exploited, these could allow an unauthenticated remote attacker to compromise the availability or confidentiality of the SICK ICR890-4. Currently, SICK is not aware of any public exploits that specifically target any of the vulnerabilities.

SICK has released a new version of the SICK ICR890-4 firmware and recommends updating to the latest version.

Vulnerabilities 8

  • High 8.6
    CVE-2023-3270

    Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote a…

    SICK ICR890-4
  • High 8.2
    CVE-2023-3271

    Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about…

    SICK ICR890-4
  • High 7.5
    CVE-2023-3272

    Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive …

    SICK ICR890-4
  • High 7.5
    CVE-2023-3273

    Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability …

    SICK ICR890-4
  • High 7.5
    CVE-2023-35696

    Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive inf…

    SICK ICR890-4
  • Medium 5.3
    CVE-2023-35697

    Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-f…

    SICK ICR890-4
  • Medium 5.3
    CVE-2023-35698

    Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the …

    SICK ICR890-4
  • Medium 5.3
    CVE-2023-35699

    Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device …

    SICK ICR890-4

Revision history

  1. #3

    Updated Advisory: URL for SICK Operating Guidelines has been updated

  2. #2

    Added self reference in CSAF

  3. #1

    Initial Release

References