CVE-2023-4420

Critical

Description

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.

SeverityCritical
CVSS9.8
Exploit probability—
ProductSick Lms531 Firmware
PublishedAug 24, 2023
First seenAug 24, 2023

How to fix

Affected products

ProductAffected versionsFixed in
sick lms531_firmwareNo range specified—
sick lms511_firmwareNo range specified—
sick lms500_firmwareNo range specified—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.