PT-2023-3722 · Elenos · Elenos Etg150 Fm Transmitter

Eslam Kamal + 1 · Published 2023-06-23 · Updated 2023-07-05 · CVE-2023-34671

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elenos ETG150 FM transmitter version 3.12

Description The issue is related to improper access control, which can lead to privilege escalation. This can be exploited by utilizing a user's role in their profile. In some cases, an attack could be conducted over the public Internet. The vulnerability is also associated with deficiencies in access control in the Memcached service of the Elenos ETG150 FM transmitter's firmware, allowing a remote attacker to potentially elevate their privileges.

Recommendations For Elenos ETG150 FM transmitter version 3.12, consider restricting access to the user profile and user role to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of the Memcached service to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-04010

CVE-2023-34671

Affected Products

Elenos Etg150 Fm Transmitter

References · 6

• 🔥 https://strik3r.gitbook.io/strik3r-blog/security-research/cves-pocs/cve-2023-34671 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34671 · Security Note
• https://bdu.fstec.ru/vul/2023-04010 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34671 · Vendor Advisory
• http://elenos.com · Note
• https://vuldb.com/ru/?id.232310 · Note