CVE-2023-23444
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to disrupt SICK Flexi Classic and Flexi Soft Gateways by changing their IP settings via broadcasted UDP packets. Attackers can cause denial of service by making devices unreachable on the network. Organizations using the affected SICK industrial gateways are impacted.
💻 Affected Systems
- SICK Flexi Classic Gateways
- SICK Flexi Soft Gateways
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network isolation of affected devices, disrupting industrial operations and causing production downtime.
Likely Case
Temporary network connectivity loss requiring manual intervention to restore proper IP configuration.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing unauthorized UDP traffic.
🎯 Exploit Status
Exploitation requires sending crafted UDP packets to broadcast addresses, which is trivial for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific firmware versions
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Check affected part numbers. 2. Download latest firmware from SICK support portal. 3. Follow SICK's firmware update procedure. 4. Verify IP settings after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLANs with strict firewall rules
UDP Broadcast Filtering
allBlock UDP broadcast packets to affected devices at network perimeter
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from untrusted networks
- Deploy network monitoring to detect and alert on suspicious UDP broadcast traffic
🔍 How to Verify
Check if Vulnerable:
Check device part number against affected list and verify if running vulnerable firmwareCheck Version:
Check via SICK SOPAS ET configuration tool or device web interfaceVerify Fix Applied:
Confirm firmware version is updated per vendor advisory and test UDP broadcast packets no longer affect IP settings📡 Detection & Monitoring
Log Indicators:
- Unexpected IP address changes
- Network connectivity loss logs
- Broadcast UDP packet reception
Network Indicators:
- UDP broadcast packets to port 30718 (typical SICK port)
- Unusual UDP traffic to industrial devices
SIEM Query:
udp.dstport == 30718 AND udp.length > 100