description:
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP
address based on missing access control.
problem types: CWE-284 Improper Access Control
affected:
{
defaultStatus: affected
product: ICR890-4
vendor: SICK AG
versions:
lessThan: 2.5.0, status: affected, version: 0, versionType: *
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
SICK recommends to disable port 2111 & 2122 once the SICK ICR890-4 is put into operation.