CVE-2023-23450
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD
Description
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR
FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526
allows an unprivileged remote attacker to use a password hash instead of an actual password to login
to a valid user account via the REST interface.
Affected (7)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esd20axx | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esd25axx | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esn40sxx | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esn50sxx | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esr50sxx | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esr40sxx | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.0 |
| Running on/with | Platform Versions |
|---|---|
Sick Ftmg Esd15axx | All versions |
Related CWEs
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-836
Use of Password Hash Instead of Password for Authentication
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
References (6)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.