PT-2023-27074 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Published 2023-10-31 · Updated 2023-11-09 · CVE-2023-39695

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM Transmitter version 3.12

Description The issue is related to insufficient session expiration, allowing attackers to change transmitter configuration and data after a user has logged out.

Recommendations For Elenos ETG150 FM Transmitter version 3.12, consider implementing proper session expiration mechanisms to prevent unauthorized access after logout. As a temporary workaround, restrict access to the transmitter configuration and data to minimize the risk of exploitation.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-39695

Affected Products

Elenos Etg150 Fm Transmitter

References · 5

• 🔥 https://github.com/strik3r0x1/Vulns/blob/35fe4fb3d5945b5df2a87aab0cf9ec6137bcf976/Insufficient%20Session%20Expiration%20-%20Elenos.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-39695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39695 · Security Note
• https://twitter.com/CVEnew/status/1719487762225590375 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1719510079345479789 · Twitter Post