CVE-2023-43696
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to download and upload arbitrary files via anonymous FTP access to SICK APU devices. It affects SICK APU products with vulnerable configurations, potentially exposing sensitive data or allowing system compromise.
💻 Affected Systems
- SICK APU (Application Programming Unit)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through malicious file upload leading to remote code execution, data exfiltration, or device takeover.
Likely Case
Unauthorized access to sensitive configuration files, firmware, or logs; potential for data theft or system manipulation.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external FTP access.
🎯 Exploit Status
Exploitation requires only FTP client access; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Access vendor advisory at sick.com/psirt. 2. Identify applicable firmware update. 3. Download and apply patch per vendor instructions. 4. Restart device as required.
🔧 Temporary Workarounds
Disable FTP Service
allTurn off FTP server functionality if not required for operations.
Device-specific; consult SICK APU configuration guide
Restrict Network Access
linux/windowsBlock FTP port (typically 21) at network perimeter or firewall.
iptables -A INPUT -p tcp --dport 21 -j DROP
netsh advfirewall firewall add rule name="Block FTP" dir=in action=block protocol=TCP localport=21
🧯 If You Can't Patch
- Isolate affected devices in segmented network with strict access controls.
- Implement network monitoring for FTP traffic to/from APU devices.
🔍 How to Verify
Check if Vulnerable:
Attempt anonymous FTP connection to device on port 21; if successful without credentials, device is likely vulnerable.Check Version:
Device-specific; typically via web interface or serial console command (e.g., 'show version' or similar).Verify Fix Applied:
After patching, attempt anonymous FTP connection; it should fail or require authentication.📡 Detection & Monitoring
Log Indicators:
- Anonymous FTP login attempts in device logs
- Unexpected file transfers via FTP
Network Indicators:
- FTP traffic to/from APU devices from untrusted sources
- Port 21 scans targeting APU IPs
SIEM Query:
source_ip="APU_IP" AND dest_port=21 AND protocol=FTP