PT-2023-6584 · Sielco · Sielco Polyeco1000

Gjoko Krstic · Published 2023-10-26 · Updated 2023-11-07 · CVE-2023-46663

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sielco PolyEco1000 (affected versions not specified)

Description The issue is related to insufficient access control in the web interface of the Sielco PolyEco1000 digital fm-transmitter's firmware. This allows an attacker to bypass authorization and access resources behind protected pages by sending specially crafted HTTP requests. The application interface does not perform validity checks to verify the requests, enabling the attacker to perform arbitrary actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-07349

CVE-2023-46663

Affected Products

Sielco Polyeco1000

References · 8

• https://osv.dev/vulnerability/CVE-2023-46663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46663 · Security Note
• https://bdu.fstec.ru/vul/2023-07349 · Security Note
• https://t.me/latest_high_impact_cve/54 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1717673363588411894 · Twitter Post
• https://twitter.com/CVEnew/status/1717639198210175064 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-299-07 · Note
• https://t.me/cibsecurity/73003 · Telegram Post