description:
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
problem types: CWE-284 (Improper Access Control)
affected:
{
defaultStatus: affected
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
{
defaultStatus: affected
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
vendor: SICK AG
versions:
lessThan: v3.0.0.131.Release, status: affected, version: 0, versionType: *
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
SICK has released a new major version v3.0.0.131.Release of the SICK FTMg firmware and
recommends updating to the newest version.