Sick ICR890-4 Firmware vulnerabilities

8 CVEs affecting Sick ICR890-4 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-3273, published 2023-07-10.

More from Sick.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-3273, published 2023-07-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on…
• CVE-2023-3270, published 2023-07-10. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.
• CVE-2023-35696, published 2023-07-10. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
• CVE-2023-3271, published 2023-07-10. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated…
• CVE-2023-35697, published 2023-07-10. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
• CVE-2023-35698, published 2023-07-10. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
• CVE-2023-3272, published 2023-07-10. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.
• CVE-2023-35699, published 2023-07-10. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.