Security readout for executives and security teams
Plain-English summary
CVE-2023-35699 means sensitive data may be stored unencrypted on the SD card of SICK ICR890-4 devices. The main business risk is information exposure if someone can physically access the device or removable storage. This is not described as a remote internet attack.
Executive priority
Treat this as a moderate physical-access confidentiality risk. Prioritize sites where devices are publicly reachable, shared with contractors, or deployed in less controlled operational environments. It is less urgent than remotely exploitable vulnerabilities but still relevant for sensitive industrial data protection.
Technical view
The issue is CWE-313 cleartext storage on disk in SICK ICR890-4. CVSS 3.1 is 5.3 with physical attack vector, low complexity, no privileges, no user interaction, changed scope, and high confidentiality impact. The source bundle does not identify integrity or availability impact.
Likely exposure
Exposure is most likely where SICK ICR890-4 devices are deployed in locations where unauthorized people can access the device or SD card. The bundle lists the product as affected but provides limited version detail beyond version 0/default affected status.
Exploitation context
The source bundle supports local physical access as the required attack condition. It does not support active exploitation, public exploit use, or remote exploitation. CISA KEV status is false in the provided data.
Researcher notes
Evidence is limited to the CVE record and SICK advisory references. The bundle does not name a patch, firmware version, or detailed remediation. Avoid assuming broader SICK product exposure. Validation should focus on product presence, physical media access, and vendor advisory follow-up.
Mitigation direction
- Inventory SICK ICR890-4 deployments and confirm whether SD cards are physically accessible.
- Review SICK PSIRT advisory SCA-2023-0006 for vendor remediation or compensating controls.
- Restrict physical access to affected devices and removable storage media.
- Handle removed SD cards as sensitive media until vendor guidance confirms exposure risk.
- Update internal asset and risk records with the vendor advisory status.
Validation and detection
- Confirm whether any SICK ICR890-4 devices are present in production or field environments.
- Check device locations for unauthorized physical access paths to SD cards.
- Review vendor advisory applicability against deployed device versions and configurations.
- Assess what sensitive data could be present on removable storage.
- Document non-exposure if no affected product is deployed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-313: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-35699 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N0.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://sick.com/psirtCVE reference · issue-tracking
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfCVE reference · vendor-advisory
- https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonCVE reference · x_csaf
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage in a File or on Disk
Cleartext Storage in a File or on Disk represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.