by Kastro
Paper/Archive/CVE-2023-42769

CVE-2023-42769

Sielco Analog FM transmitter — Sielco Radio Link and Analog FM Transmitters Improper Access Control

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.

Affected

ProductAffectedFixed inSource
Analog FM transmitter2.12 (EXC5000GX)–CNA
Analog FM transmitter2.12 (EXC120GX)–CNA
Analog FM transmitter2.11 (EXC300GX)–CNA
Analog FM transmitter2.10 (EXC1600GX)–CNA
Analog FM transmitter2.10 (EXC2000GX)–CNA
Analog FM transmitter2.08 (EXC1600GX)–CNA
Analog FM transmitter2.08 (EXC1000GX)–CNA
Analog FM transmitter2.07 (EXC3000GX)–CNA
Analog FM transmitter2.06 (EXC5000GX)–CNA
Analog FM transmitter1.7.7 (EXC30GT)–CNA
Analog FM transmitter1.7.4 (EXC300GT)–CNA
Analog FM transmitter1.7.4 (EXC100GT)–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-299-08refsielco.org/en/contacts