CVE-2023-23450

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via the REST interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-836 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-234519.8The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE4 CVE-2023-234529.8Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to CVE-2023-234539.8Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to CVE-2023-234545.5cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read CVE-2023-234555.5atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confus CVE-2023-234565.5A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial CVE-2023-234575.5A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows i CVE-2023-234586.5Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.CVE-2023-234599.8Priority Windows may allow Command Execution via SQL Injection using an unspecified method.CVE-2023-23469.8A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unkn CVE-2023-234609.8Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.CVE-2023-234619.8Libpeconv – access violation, before commit b076013 (30/11/2022).