CVE-2023-31409

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
SICK AG	SICK FTMG-ESD15AXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESD20AXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESD25AXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESN40SXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESN50SXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESR40SXX AIR FLOW SENSOR	all firmware versions
SICK AG	SICK FTMG-ESR50SXX AIR FLOW SENSOR	all firmware versions

References

https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdfVendor Advisory
https://sick.com/psirtVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdfVendor Advisory
https://sick.com/psirtVendor Advisory

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-31417.1A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local CVE-2023-314107.4A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (T CVE-2023-314119.8A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. Th CVE-2023-314127.5The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it c CVE-2023-314133.3Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization h CVE-2023-314148.8Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configurat CVE-2023-314158.8Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send CVE-2023-314165.3Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Serve CVE-2023-314174.4Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering CVE-2023-314187.5An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elas CVE-2023-314197.5A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow an CVE-2023-31425.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.