PT-2023-6585 · Sielco · Sielco Polyeco1000

Published 2023-10-26 · Updated 2023-11-06 · CVE-2023-5754

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sielco PolyEco1000 (affected versions not specified)

Description The issue is related to insufficient restriction of authentication attempts and the use of a weak set of default administrative credentials in the Sielco PolyEco1000 digital fm-transmitter software. This weakness can be exploited by a remote attacker to gain full control of the system through remote password attacks.

Recommendations As a temporary workaround, consider changing the default administrative credentials to stronger ones until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using default or easily guessable credentials in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2023-07350

CVE-2023-5754

Affected Products

Sielco Polyeco1000

References · 7

• https://osv.dev/vulnerability/CVE-2023-5754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5754 · Security Note
• https://bdu.fstec.ru/vul/2023-07350 · Security Note
• https://t.me/cibsecurity/73004 · Telegram Post
• https://t.me/cvenotify/60045 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-299-07 · Note
• https://twitter.com/CVEnew/status/1717630511969890376 · Twitter Post