Read the docs
TI-2023-03066 Aliases CVE-2023-3273GHSA-29xr-xpp4-5783

Improper access control in SICK AG ICR890-4

Priority MEDIUM 41CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01067 64th percentileScored 2026-11-07
Fix Fixed ICR890-4 (SICK AG): 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SICK AGICR890-4before 2.5.02.5.0Patch availableCNA
  • ICR890-4 VendorSICK AG Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:*before 2.5.0VulnerableSICK AG
cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
  • cpe:2.3:o:sick:icr890-4_firmware:*:*:*:*:*:*:*:* Versions before 2.5.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:icr890-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG

Remediation

  • Fix · CNA ICR890-4 (SICK AG) Fixed in 2.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SICK ICR890-4 — sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf

    8 records Highest priority Priority MEDIUM 6 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-03063 Exposure of resource to wrong sphere in SICK AG ICR890-4Priority MEDIUM 45
    • TI-2023-03064 Improper access control in SICK AG ICR890-4Priority MEDIUM 43
    • TI-2023-17798 Missing brute-force protection in SICK AG ICR890-4Priority MEDIUM 41
    Show all 8 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3273
  2. 2026-10-03 Alias added: GHSA-29xr-xpp4-5783

References

Advisory 2

Other 1

  • TI-2023-03063 Exposure of resource to wrong sphere in SICK AG ICR890-4 CVSS 3.1HIGH 8.6
  • TI-2023-03064 Improper access control in SICK AG ICR890-4 CVSS 3.1HIGH 8.2
  • TI-2023-17798 Missing brute-force protection in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-17797 Exposure of resource to wrong sphere in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-03065 Cleartext transmission of sensitive information in SICK AG ICR890-4 CVSS 3.1HIGH 7.5
  • TI-2023-17799 Observable discrepancy in SICK AG ICR890-4 CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences