sca-2023-0011
Vulnerability from csaf_sick
Published
2023-10-23 11:00
Modified
2023-10-23 11:00
Summary
Vulnerability in multiple SICK Flexi Soft Gateways

Notes

Summary
The SICK PSIRT received a report about a vulnerability in several Flexi Soft Gateways that could allow an attacker to login to the gateways by sending specially crafted packets and potentially impact the availabilty, integrity and confidentiality of the devices. SICK recommends making sure to run the product in a secure environment. SICK is not aware of an exploit targeting this vulnerability.
General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.


To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "The SICK PSIRT received a report about a vulnerability in several Flexi Soft Gateways that could allow an attacker to login to the gateways by sending specially crafted packets and potentially impact the availabilty, integrity and confidentiality of the devices.\n\nSICK recommends making sure to run the product in a secure environment. SICK is not aware of an exploit targeting this vulnerability.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://www.sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://www.sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2023/sca-2023-0011.json"
      },
      {
        "category": "self",
        "summary": "The canonical PDF URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf"
      }
    ],
    "title": "Vulnerability in multiple SICK Flexi Soft Gateways",
    "tracking": {
      "current_release_date": "2023-10-23T11:00:00.000Z",
      "generator": {
        "date": "2023-12-04T10:38:59.359Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.2.16"
        }
      },
      "id": "SCA-2023-0011",
      "initial_release_date": "2023-10-23T11:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-10-23T11:00:00.000Z",
          "number": "1",
          "summary": "Initial Release"
        },
        {
          "date": "2023-12-04T11:00:00.000Z",
          "number": "2",
          "summary": "Added self reference in CSAF"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00000 all versions",
                  "product_id": "CSAFPID-0019",
                  "product_identification_helper": {
                    "skus": [
                      "1044073"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00010 all versions",
                  "product_id": "CSAFPID-0020",
                  "product_identification_helper": {
                    "skus": [
                      "1127717"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00010"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00030 all versions",
                  "product_id": "CSAFPID-0021",
                  "product_identification_helper": {
                    "skus": [
                      "1130282"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00030"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00000 all versions",
                  "product_id": "CSAFPID-0022",
                  "product_identification_helper": {
                    "skus": [
                      "1044074"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00010 all versions",
                  "product_id": "CSAFPID-0023",
                  "product_identification_helper": {
                    "skus": [
                      "1121597"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00010"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00030 all versions",
                  "product_id": "CSAFPID-0024",
                  "product_identification_helper": {
                    "skus": [
                      "1099832"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00030"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GETC00000 all versions",
                  "product_id": "CSAFPID-0025",
                  "product_identification_helper": {
                    "skus": [
                      "1051432"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GETC00000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GETC00010 all versions",
                  "product_id": "CSAFPID-0026",
                  "product_identification_helper": {
                    "skus": [
                      "1127487"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GETC00010"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX3-GEPR00000 all versions",
                  "product_id": "CSAFPID-0027",
                  "product_identification_helper": {
                    "skus": [
                      "1069070"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX3-GEPR00000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX3-GEPR00010 all versions",
                  "product_id": "CSAFPID-0028",
                  "product_identification_helper": {
                    "skus": [
                      "1112296"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX3-GEPR00010"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00000 all versions",
                  "product_id": "CSAFPID-0029",
                  "product_identification_helper": {
                    "skus": [
                      "1044072"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00010 all versions",
                  "product_id": "CSAFPID-0030",
                  "product_identification_helper": {
                    "skus": [
                      "1121596"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00010"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00030 all versions",
                  "product_id": "CSAFPID-0031",
                  "product_identification_helper": {
                    "skus": [
                      "1099830"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00030"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00000 Firmware all versions",
                  "product_id": "CSAFPID-0032"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00000 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00010 Firmware all versions",
                  "product_id": "CSAFPID-0033"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00010 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GMOD00030 Firmware all versions",
                  "product_id": "CSAFPID-0034"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GMOD00030 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00000 Firmware all versions",
                  "product_id": "CSAFPID-0035"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00000 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00010 Firmware all versions",
                  "product_id": "CSAFPID-0036"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00010 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GPNT00030 Firmware all versions",
                  "product_id": "CSAFPID-0037"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GPNT00030 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GETC00000 Firmware all versions",
                  "product_id": "CSAFPID-0038"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GETC00000 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GETC00010 Firmware all versions",
                  "product_id": "CSAFPID-0039"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GETC00010 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX3-GEPR00000 Firmware all versions",
                  "product_id": "CSAFPID-0040"
                }
              }
            ],
            "category": "product_name",
            "name": "FX3-GEPR00000 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX3-GEPR00010 Firmware all versions",
                  "product_id": "CSAFPID-0041"
                }
              }
            ],
            "category": "product_name",
            "name": "FX3-GEPR00010 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00000 Firmware all versions",
                  "product_id": "CSAFPID-0042"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00000 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00010 Firmware all versions",
                  "product_id": "CSAFPID-0043"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00010 Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK FX0-GENT00030 Firmware all versions",
                  "product_id": "CSAFPID-0044"
                }
              }
            ],
            "category": "product_name",
            "name": "FX0-GENT00030 Firmware"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GMOD00000 all Firmware versions",
          "product_id": "CSAFPID-0045"
        },
        "product_reference": "CSAFPID-0032",
        "relates_to_product_reference": "CSAFPID-0019"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GMOD00010 all Firmware versions",
          "product_id": "CSAFPID-0046"
        },
        "product_reference": "CSAFPID-0033",
        "relates_to_product_reference": "CSAFPID-0020"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GMOD00030 all Firmware versions",
          "product_id": "CSAFPID-0047"
        },
        "product_reference": "CSAFPID-0034",
        "relates_to_product_reference": "CSAFPID-0021"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GPNT00000 all Firmware versions",
          "product_id": "CSAFPID-0048"
        },
        "product_reference": "CSAFPID-0035",
        "relates_to_product_reference": "CSAFPID-0022"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GPNT00010 all Firmware versions",
          "product_id": "CSAFPID-0049"
        },
        "product_reference": "CSAFPID-0036",
        "relates_to_product_reference": "CSAFPID-0023"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GPNT00030 all Firmware versions",
          "product_id": "CSAFPID-0050"
        },
        "product_reference": "CSAFPID-0037",
        "relates_to_product_reference": "CSAFPID-0024"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GETC00000 all Firmware versions",
          "product_id": "CSAFPID-0051"
        },
        "product_reference": "CSAFPID-0038",
        "relates_to_product_reference": "CSAFPID-0025"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GETC00010 all Firmware versions",
          "product_id": "CSAFPID-0052"
        },
        "product_reference": "CSAFPID-0039",
        "relates_to_product_reference": "CSAFPID-0026"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX3-GEPR00000 all Firmware versions",
          "product_id": "CSAFPID-0053"
        },
        "product_reference": "CSAFPID-0040",
        "relates_to_product_reference": "CSAFPID-0027"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX3-GEPR00010 all Firmware versions",
          "product_id": "CSAFPID-0054"
        },
        "product_reference": "CSAFPID-0041",
        "relates_to_product_reference": "CSAFPID-0028"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GENT00000 all Firmware versions",
          "product_id": "CSAFPID-0055"
        },
        "product_reference": "CSAFPID-0042",
        "relates_to_product_reference": "CSAFPID-0029"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GENT00010 all Firmware versions",
          "product_id": "CSAFPID-0056"
        },
        "product_reference": "CSAFPID-0043",
        "relates_to_product_reference": "CSAFPID-0030"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "SICK FX0-GENT00030 all Firmware versions",
          "product_id": "CSAFPID-0057"
        },
        "product_reference": "CSAFPID-0044",
        "relates_to_product_reference": "CSAFPID-0031"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5246",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availabilty, integrity and confidentaility of the gateways via an authentication bypass by capture-replay.",
          "title": "CVE Description"
        },
        {
          "category": "general",
          "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.\n\nAdditional information on Industrial Security can be found at: \n\nhttp://ics-cert.us-cert.gov/content/recommended-practices",
          "title": "General Security Measures"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0049",
          "CSAFPID-0050",
          "CSAFPID-0051",
          "CSAFPID-0052",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0055",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ]
      },
      "remediations": [
        {
          "category": "workaround",
          "date": "2023-10-23T10:00:00.000Z",
          "details": "Please make sure that you apply general security practices when operating the SICK Flexi Soft Gateways. The following General Security Practices and Operating Guidelines could mitigate the associated security risk.\n",
          "product_ids": [
            "CSAFPID-0045",
            "CSAFPID-0046",
            "CSAFPID-0047",
            "CSAFPID-0048",
            "CSAFPID-0049",
            "CSAFPID-0050",
            "CSAFPID-0051",
            "CSAFPID-0052",
            "CSAFPID-0053",
            "CSAFPID-0054",
            "CSAFPID-0055",
            "CSAFPID-0056",
            "CSAFPID-0057"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0045",
            "CSAFPID-0046",
            "CSAFPID-0047",
            "CSAFPID-0048",
            "CSAFPID-0049",
            "CSAFPID-0050",
            "CSAFPID-0051",
            "CSAFPID-0052",
            "CSAFPID-0053",
            "CSAFPID-0054",
            "CSAFPID-0055",
            "CSAFPID-0056",
            "CSAFPID-0057"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.