PT-2023-3720 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Publicado 2023-06-23 · Atualizado 2024-12-05 · CVE-2023-34672

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to improper access control, which can be exploited to add a high-privilege user by leveraging the user's role within the admin profile. This can potentially be done over the public Internet. The vulnerability is associated with software deficiencies in access control.

Recommendations For version 3.12, consider restricting access to the admin profile to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and limit user roles within the admin profile to prevent unauthorized privilege escalation.

Exploit

Correção

Improper Access Control

Improper Preservation of Permissions

Enumeração de Fraquezas

CWE-284

CWE-281

Identificadores relacionados

BDU:2023-04008

CVE-2023-34672

Produtos afetados

Elenos Etg150 Fm Transmitter

Referências · 7

• 🔥 https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34672 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34672 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04008 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34672 · Aviso do Fabricante
• https://t.me/cvenotify/103112 · Publicação no Telegram
• https://vuldb.com/?id.232312 · Nota
• http://elenos.com · Nota