CVE-2023-31409
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524,…
- Published
- Updated
- Reserved
- Assigned by
- SICK AG
Description
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.
Timeline
ID reserved
By SICK AG
- 18 days later
· 18 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| SICK AGCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.1% · top 34% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
SICK AG · SICK FTMG-ESD15AXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESD20AXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESD25AXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESN40SXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESN50SXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESR40SXX AIR FLOW SENSOR
- affected all firmware versions
SICK AG · SICK FTMG-ESR50SXX AIR FLOW SENSOR
- affected all firmware versions
What to do
Workaround: Please make sure that you apply general security practices when operating the SICK FTMg like network segmentation. The following General Security Practices and Operating Guidelines could mitigate the associated security risk.
References (3)
- https://sick.com/psirt (opens in a new tab)issue-trackingx_transferred
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf (opens in a new tab)vendor-advisoryx_transferred
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json (opens in a new tab)x_csafx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-31409)Record last updated .