PT-2023-3722 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Publicado 2023-06-23 · Atualizado 2023-07-05 · CVE-2023-34671

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to improper access control, which can lead to privilege escalation. This can be exploited by utilizing a user's role in their profile. In some cases, an attack could be conducted over the public Internet. The vulnerability is also associated with deficiencies in access control in the Memcached service of the Elenos ETG150 FM transmitter's firmware, allowing a remote attacker to potentially elevate their privileges.

Recommendations For Elenos ETG150 FM transmitter version 3.12, consider restricting access to the user profile and user role to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of the Memcached service to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-04010

CVE-2023-34671

Produtos afetados

Elenos Etg150 Fm Transmitter

Referências · 6

• 🔥 https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34671 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34671 · Nota de Segurança
• http://elenos.com · Nota
• https://bdu.fstec.ru/vul/2023-04010 · Nota de Segurança
• https://vuldb.com/ru/?id.232310 · Nota
• https://osv.dev/vulnerability/CVE-2023-34671 · Aviso do Fabricante