PT-2023-3721 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Published 2023-06-23 · Updated 2023-07-05 · CVE-2023-34673

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to insufficient protection of service data, allowing an attacker to gain unauthorized access to sensitive information. This can be exploited by accessing the publicly accessible Memcached service, potentially over the public Internet. The leak includes SMTP credentials and other sensitive information.

Recommendations For Elenos ETG150 FM transmitter version 3.12, consider restricting access to the Memcached service to minimize the risk of exploitation. As a temporary workaround, limit public Internet access to the transmitter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-04009

CVE-2023-34673

Affected Products

Elenos Etg150 Fm Transmitter

References · 7

• 🔥 https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34673 · Security Note
• https://bdu.fstec.ru/vul/2023-04009 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34673 · Vendor Advisory
• http://elenos.com · Note
• https://t.me/cvenotify/53664 · Telegram Post
• https://vuldb.com/ru/?id.232308 · Note