PT-2023-23741 · Teltonika · Teltonika'S Remote Management System

Claroty Research + 2 · Publicado 2023-05-22 · Atualizado 2023-06-01 · CVE-2023-32348

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Teltonika’s Remote Management System versions prior to 4.10.0

Description The issue concerns the virtual private network (VPN) hub feature in Teltonika’s Remote Management System, which utilizes OpenVPN for cross-device communication. This feature allows new devices to connect and communicate with all Teltonika devices already connected to the VPN. Additionally, the OpenVPN server enables users to route through it. An attacker could exploit this by routing a connection to a remote server through the OpenVPN server, thereby gaining the ability to scan and access data from other Teltonika devices connected to the VPN.

Recommendations For versions prior to 4.10.0, update to version 4.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN server to minimize the risk of exploitation. Avoid using the VPN hub feature until the issue is resolved.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-32348

Produtos afetados

Teltonika'S Remote Management System

Referências · 4

• https://osv.dev/vulnerability/CVE-2023-32348 · Aviso do Fabricante
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-08 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-32348 · Nota de Segurança
• https://t.me/cibsecurity/64549 · Publicação no Telegram