PT-2023-3720 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Published 2023-06-23 · Updated 2024-12-05 · CVE-2023-34672

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to improper access control, which can be exploited to add a high-privilege user by leveraging the user's role within the admin profile. This can potentially be done over the public Internet. The vulnerability is associated with software deficiencies in access control.

Recommendations For version 3.12, consider restricting access to the admin profile to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and limit user roles within the admin profile to prevent unauthorized privilege escalation.

Exploit

Fix

Improper Access Control

Improper Preservation of Permissions

Weakness Enumeration

CWE-284

CWE-281

Related Identifiers

BDU:2023-04008

CVE-2023-34672

Affected Products

Elenos Etg150 Fm Transmitter

References · 7

• 🔥 https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34672 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34672 · Security Note
• https://bdu.fstec.ru/vul/2023-04008 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34672 · Vendor Advisory
• https://t.me/cvenotify/103112 · Telegram Post
• https://vuldb.com/?id.232312 · Note
• http://elenos.com · Note