CVE-2023-4420 describes a critical vulnerability in SICK LMS5xx series devices, including the LMS500, LMS511, and LMS531, where the absence of Transport Layer Security (TLS) allows for unencrypted communication. This flaw enables a remote, unprivileged attacker to perform Man-in-the-Middle attacks, leading to the unauthorized disclosure and potential manipulation of sensitive data. With a CVSS score of 7.4 (HIGH), the vulnerability has a network attack vector and high impact on confidentiality and integrity, despite high attack complexity. Currently, there is no evidence of active exploitation, nor are there public exploit codes available in Metasploit, Nuclei, or ExploitDB, though it has garnered significant community discussion with 10 mentions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:sick:lms531_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:sick:lms511_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:sick:lms500_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.