Read the docs
TI-2023-09293 Aliases CVE-2023-23451GHSA-j4pp-rp58-2qhj

Missing authentication in SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000…

Priority MEDIUM 50CWE-477Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306.

Summary

The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00621 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
N/ASICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000, SICK FX0-GMOD00010, SICK FX0-GPNT00000, SICK FX0-GPNT00030, SICK UE410-EN1, SICK UE410-EN3, SICK UE410-EN3S04, SICK UE410-EN4up to 2311xxxx; up to V2.11.0—No fix listedCNA
  • SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000, SICK FX0-GMOD00010, SICK FX0-GPNT00000, SICK FX0-GPNT00030, SICK UE410-EN1, SICK UE410-EN3, SICK UE410-EN3S04, SICK UE410-EN4 VendorN/A Affected up to 2311xxxx; up to V2.11.0 Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:o:sick:ue410-en3_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:ue410-en3:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:ue410-en1_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:ue410-en1:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:ue410-en3s04_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:ue410-en3s04:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:ue410-en4_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:ue410-en4:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:fx0-gent00000_firmware:*:*:*:*:*:*:*:*up to 2.11.0VulnerableSICK AG
cpe:2.3:h:sick:fx0-gent00000:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
  • cpe:2.3:o:sick:ue410-en3_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:ue410-en3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:ue410-en1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:ue410-en1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:ue410-en3s04_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:ue410-en3s04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:ue410-en4_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:ue410-en4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:fx0-gent00000_firmware:*:*:*:*:*:*:*:* Versions up to 2.11.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gent00000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:sick:fx0-gmod00000_firmware:*:*:*:*:*:*:*:*up to 2.11.0VulnerableSICK AG
cpe:2.3:h:sick:fx0-gmod00000:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:fx0-gpnt00000_firmware:*:*:*:*:*:*:*:*up to 2.12.0VulnerableSICK AG
cpe:2.3:h:sick:fx0-gpnt00000:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:fx0-gent00030_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:fx0-gent00030:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:fx0-gpnt00030_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSICK AG
cpe:2.3:h:sick:fx0-gpnt00030:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
cpe:2.3:o:sick:fx0-gmod00010_firmware:*:*:*:*:*:*:*:*up to 2.11.0VulnerableSICK AG
cpe:2.3:h:sick:fx0-gmod00010:-:*:*:*:*:*:*:*not specified by NVDRunning onSICK AG
  • cpe:2.3:o:sick:fx0-gmod00000_firmware:*:*:*:*:*:*:*:* Versions up to 2.11.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gmod00000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:fx0-gpnt00000_firmware:*:*:*:*:*:*:*:* Versions up to 2.12.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gpnt00000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:fx0-gent00030_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gent00030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:fx0-gpnt00030_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gpnt00030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG
  • cpe:2.3:o:sick:fx0-gmod00010_firmware:*:*:*:*:*:*:*:* Versions up to 2.11.0 Vulnerable ·SICK AG
  • cpe:2.3:h:sick:fx0-gmod00010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SICK AG

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23451
  2. 2026-10-03 Alias added: GHSA-j4pp-rp58-2qhj
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2023-09295 Missing authentication in FX0-GENT v3 Firmware CVSS 3.1CRITICAL 9.8
  • TI-2023-09286 Missing authentication in SICK AG UE410-EN3 FLEXI ETHERNET GATEW. CVSS 3.1HIGH 8.2
  • TI-2023-04823 Improper authentication in SICK AG FX0-GMOD00000 CVSS 3.1HIGH 8.8
  • TI-2019-10965 SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences