PT-2023-26137 · Elenos · Elenos Etg150 Fm Transmitter

Strik3R · Published 2023-10-31 · Updated 2023-11-08 · CVE-2023-37833

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to improper access control, allowing attackers to make arbitrary configuration edits that are normally only accessible by privileged users.

Recommendations For Elenos ETG150 FM transmitter version 3.12, consider restricting access to configuration edit features until a patch is available. As a temporary workaround, limit the privileges of non-administrative users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-37833

Affected Products

Elenos Etg150 Fm Transmitter

References · 7

• 🔥 https://github.com/strik3r0x1/Vulns/blob/main/BAC%20leads%20to%20access%20Traps%20configurations.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37833 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37833 · Vendor Advisory
• https://t.me/cibsecurity/73279 · Telegram Post
• https://t.me/cvenotify/60263 · Telegram Post
• https://twitter.com/CVEnew/status/1719484428647272509 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1719510585719550080 · Twitter Post