CVE-2023-3273

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
SICK AG	ICR890-4	< 2.5.0
sick_ag	icr890-4	< 2.5.0

References

https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfVendor Advisory
https://sick.com/psirtProduct
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfVendor Advisory
https://sick.com/psirtProduct

Timeline

Published: Jul 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-327317.5When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutat CVE-2023-327325.3gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encod CVE-2023-327347.8The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watch CVE-2023-327356.5A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V1 CVE-2023-327367.3A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 CVE-2023-327376.3A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restri CVE-2023-327384.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions.CVE-2023-327398.8Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.CVE-2023-32748.8A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of th CVE-2023-327406.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.CVE-2023-327417.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form CVE-2023-327426.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.