PT-2023-23304 · Sick · Sick Eventcam App

Published 2023-06-19 · Updated 2023-06-29 · CVE-2023-31410

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICK EventCam App (affected versions not specified)

Description A remote unprivileged attacker can intercept communication via Man-In-The-Middle attacks due to the absence of Transport Layer Security (TLS) in the app. This lack of encryption can lead to unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on communication between the EventCam App and the Client, and potentially manipulate transmitted data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-31410

Affected Products

Sick Eventcam App

References · 4

• https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31410 · Security Note
• https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json · Vendor Advisory
• https://sick.com/psirt · Vendor Advisory