Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
Solution:
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
| Link | Tags |
|---|---|
| https://sick.com/psirt | product issue tracking |
| https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf | vendor advisory |
| https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json | vendor advisory |