PT-2023-16501 · Unknown · Yellobrik Pec-1864

Vincent Salvadori · Publicado 2023-04-06 · Atualizado 2023-04-18 · CVE-2023-0750

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yellobrik PEC-1864 (affected versions not specified)

Description The Yellobrik PEC-1864 device implements authentication checks via JavaScript in the frontend interface. When the device can be accessed over the network, an attacker could bypass authentication. This would allow an attacker to change the password, resulting in a denial of service for the users, change the streaming source, compromising the integrity of the stream, and change the streaming destination, compromising the confidentiality of the stream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

CWE-602

Identificadores relacionados

CVE-2023-0750

Produtos afetados

Yellobrik Pec-1864

Referências · 3

• https://support.lynx-technik.com/support/solutions/articles/1000317081-pec-1864-web-ui-for-configuration · Aviso do Fabricante
• https://t.me/cibsecurity/61565 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0750 · Nota de Segurança