Skip to content
Fencer Vulns
high 7.5

CVE-2023-23444 json

Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044…

published 2023-05-12 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-27544

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP packets.

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

  • SICK AG UE410-EN3 FLEXI ETHERNET GATEW.
  • SICK AG UE410-EN1 FLEXI ETHERNET GATEW.
  • SICK AG UE410-EN4 FLEXI ETHERNET GATEW.
  • SICK AG FX0-GENT00000 FLEXISOFT EIP GATEW.
  • SICK AG FX0-GMOD00000 FLEXISOFT MOD GATEW.
  • SICK AG FX0-GPNT00000 FLEXISOFT PNET GATEW.
  • SICK AG FX0-GENT00030 FLEXISOFT EIP GATEW.V2
  • SICK AG FX0-GPNT00030 FLEXISOFT PNET GATEW.V2
  • SICK AG FX0-GMOD00010 FLEXISOFT MOD GW (C)
  • SICK AG FX3-GEPR00000 FLEXISOFT EFI-PRO GW
  • SICK AG FX3-GEPR00010 FLEXISOFT EFI-PRO GW
  • SICK AG FX0-GETC00000 FLEXISOFT ETC GW
  • SICK AG FX0-GETC00040 FLEXISOFT ETC GW
  • SICK AG FX0-GETC00010 FLEXISOFT ETC GW (C)
  • SICK AG FX0-GENT00010 FLEXISOFT EIP GW (C)
  • SICK AG FX0-GPNT00010 FLEXISOFT PNET GW (C)
  • SICK AG UE410-EN3 FLEXI ETHERNET GATEW. Firmware
  • SICK AG UE410-EN1 FLEXI ETHERNET GATEW. Firmware
  • SICK AG UE410-EN4 FLEXI ETHERNET GATEW. Firmware
  • SICK AG FX0-GENT00000 FLEXISOFT EIP GATEW. Firmware
  • SICK AG FX0-GMOD00000 FLEXISOFT MOD GATEW. Firmware
  • SICK AG FX0-GPNT00000 FLEXISOFT PNET GATEW. Firmware
  • SICK AG FX0-GENT00030 FLEXISOFT EIP GATEW.V2 Firmware
  • SICK AG FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 Firmware
  • SICK AG FX0-GMOD00010 FLEXISOFT MOD GW (C) Firmware
  • SICK AG FX3-GEPR00000 FLEXISOFT EFI-PRO GW Firmware
  • SICK AG FX3-GEPR00010 FLEXISOFT EFI-PRO GW Firmware
  • SICK AG FX0-GETC00000 FLEXISOFT ETC GW Firmware
  • SICK AG FX0-GETC00040 FLEXISOFT ETC GW Firmware
  • SICK AG FX0-GETC00010 FLEXISOFT ETC GW (C) Firmware
  • SICK AG FX0-GENT00010 FLEXISOFT EIP GW (C) Firmware
  • SICK AG FX0-GPNT00010 FLEXISOFT PNET GW (C) Firmware

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.