A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App.
References
| Link | Resource |
|---|---|
| https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json | Vendor Advisory |
| https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf | Vendor Advisory |
| https://sick.com/psirt | Vendor Advisory |
Configurations
History
29 Jun 2023, 19:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sick:sick_eventcam_app:*:*:*:*:*:*:*:* | |
| CWE | CWE-306 | |
| First Time |
Sick sick Eventcam App
Sick |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | (MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json - Vendor Advisory | |
| References | (MISC) https://sick.com/psirt - Vendor Advisory | |
| References | (MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf - Vendor Advisory |
19 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-19 15:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-31411
Mitre link : CVE-2023-31411
CVE.ORG link : CVE-2023-31411
JSON object : View
Products Affected
sick
- sick_eventcam_app
CWE
CWE-306
Missing Authentication for Critical Function