PT-2023-26135 · Elenos · Elenos Etg150 Fm Transmitter

Strik3R · Published 2023-10-31 · Updated 2024-09-12 · CVE-2023-37831

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description An issue in the Elenos ETG150 FM transmitter allows attackers to enumerate user accounts based on server responses when credentials are submitted.

Recommendations For Elenos ETG150 FM transmitter version 3.12, consider restricting access to the server until a patch is available to prevent user account enumeration. As a temporary workaround, avoid submitting credentials to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2023-37831

Affected Products

Elenos Etg150 Fm Transmitter

References · 7

• 🔥 https://github.com/strik3r0x1/Vulns/blob/main/User%20enumeration%20-%20Elenos.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-37831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37831 · Security Note
• https://t.me/cibsecurity/73266 · Telegram Post
• https://twitter.com/CVEnew/status/1719408682805403947 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1719450689338744883 · Twitter Post
• https://t.me/cvenotify/94343 · Telegram Post