CVE-2023-35696
📋 TL;DR
Unauthenticated HTTP endpoints in SICK ICR890-4 industrial cameras allow remote attackers to retrieve sensitive device information without credentials. This affects all organizations using vulnerable versions of these cameras, particularly those with network exposure.
💻 Affected Systems
- SICK ICR890-4 industrial camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain detailed device information that could facilitate further attacks, including network reconnaissance, credential harvesting, or exploitation of other vulnerabilities.
Likely Case
Information disclosure revealing device configuration, network settings, and potentially sensitive operational data that could aid in targeted attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to camera management interfaces.
🎯 Exploit Status
Simple HTTP requests to specific endpoints can trigger information disclosure. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SICK PSIRT for latest firmware updates
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Check SICK PSIRT for advisory SCA-2023-0006. 2. Download latest firmware from SICK support portal. 3. Apply firmware update following manufacturer instructions. 4. Verify update completion and restart device.
🔧 Temporary Workarounds
Network segmentation
allIsolate camera management interfaces from untrusted networks
Disable HTTP management
allTurn off HTTP web interface if not required for operations
🧯 If You Can't Patch
- Implement strict network access controls to limit camera management interface access to authorized IPs only
- Monitor network traffic for unauthorized access attempts to camera HTTP endpoints
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET requests to camera management endpoints without authentication. If device information is returned, device is vulnerable.Check Version:
Check firmware version via camera web interface or SICK configuration toolsVerify Fix Applied:
After patching, repeat vulnerability check. Information should not be accessible without proper authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated HTTP requests to camera management endpoints
- Multiple failed authentication attempts followed by information requests
Network Indicators:
- HTTP GET requests to camera IP on management ports without authentication headers
- Unusual information requests from external IPs
SIEM Query:
source_ip=external AND dest_port IN (80, 443, 8080) AND http_method=GET AND NOT user_agent=*browser* AND response_size>1000