CVE-2023-23446

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-863

Affected software

Vendor	Product	Versions
SICK AG	SICK FTMG-ESD15AXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESD20AXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESD25AXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESN40SXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESN50SXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESR40SXX AIR FLOW SENSOR	< v3.0.0.131.Release
SICK AG	SICK FTMG-ESR50SXX AIR FLOW SENSOR	< v3.0.0.131.Release

References

https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdfVendor Advisory
https://sick.com/psirtVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdfVendor Advisory
https://sick.com/psirtVendor Advisory

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-234477.5Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252 CVE-2023-234485.3Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116,CVE-2023-234495.3Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 CVE-2023-23459.8A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is som CVE-2023-234509.8Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114 CVE-2023-234519.8The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE4 CVE-2023-234529.8Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to CVE-2023-234539.8Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to CVE-2023-234545.5cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read CVE-2023-234555.5atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confus CVE-2023-234565.5A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial CVE-2023-234575.5A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows i