CVE-2023-35698 - Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login

Back Back to CVE browser

MEDIUM

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login

Published Jul 10, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.78%

Description

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.

Affected products

Vendor Sick AG Product n/a Default
affected
- Version
  0
  Status
  affected
  Constraints
  <2.5.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sick AG

n/a

affected

Version	Status	Constraints
0	affected	<2.5.0

Remediation

Vendor solution

The recommended solution is to update the firmware to a version >= V2.5.0 as soon as possible.

Weaknesses (2)

CWE-203

CWE-204

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39698
Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json
x_csafVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf
vendor-advisoryVendor Advisory
https://sick.com/psirt
issue-trackingProduct

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39698		Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json		x_csafVendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf		vendor-advisoryVendor Advisory
https://sick.com/psirt		issue-trackingProduct