Read the docs
TI-2023-03064 Aliases CVE-2023-3271GHSA-fm49-53h8-h7vg

Improper access control in SICK AG ICR890-4

Priority MEDIUM 43CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0092 60th percentileScored 2026-11-07
Fix Fixed ICR890-4 (SICK AG): 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGICR890-4before 2.5.02.5.0Patch availableCNA
  • ICR890-4 VendorSICK AG Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*before 2.5.0VulnerableSICK AG
cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
  • cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:* Versions before 2.5.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG

Remediation

  • Fix · CNA ICR890-4 (SICK AG) Fixed in 2.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SICK ICR890-4 — sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf

    8 records Highest priority Priority MEDIUM 6 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-03063 Exposure of resource to wrong sphere in SICK AG ICR890-4Priority MEDIUM 45
    • TI-2023-17798 Missing brute-force protection in SICK AG ICR890-4Priority MEDIUM 41
    • TI-2023-17797 Exposure of resource to wrong sphere in SICK AG ICR890-4Priority MEDIUM 41
    Show all 8 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3271
  2. 2026-10-03 Alias added: GHSA-fm49-53h8-h7vg

References

Advisory 2

Other 1

  • TI-2023-03063 Exposure of resource to wrong sphere in SICK AG ICR890-4 CVSS 3.1HIGH 8.6
  • TI-2023-17798 Missing brute-force protection in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-17797 Exposure of resource to wrong sphere in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-03066 Improper access control in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-03065 Cleartext transmission of sensitive information in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-17799 Observable discrepancy in SICK AG ICR890-4 CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences