PT-2023-20350 · Teltonika · Teltonika'S Remote Management System

Noam Moshe + 2 · Publicado 2023-05-22 · Atualizado 2023-05-31 · CVE-2023-2586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teltonika’s Remote Management System version 4.14.0

Description The issue allows an unauthorized attacker to register previously unregistered devices through the RMS platform. If the RMS management feature is enabled, an attacker could register a device to themselves, enabling them to perform different operations on the user's devices. This includes remote code execution with root privileges using the Task Manager feature on RMS.

Recommendations For Teltonika’s Remote Management System version 4.14.0, disable the RMS management feature to prevent unauthorized device registration. As a temporary workaround, consider restricting access to the Task Manager feature on RMS until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-2586

Produtos afetados

Teltonika'S Remote Management System

Referências · 5

• https://t.me/cvenotify/51513 · Publicação no Telegram
• https://t.me/cibsecurity/64551 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-08 · Nota
• https://osv.dev/vulnerability/CVE-2023-2586 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2586 · Nota de Segurança