PT-2023-7925 · Eurotel · Eurotel Etl3100

Gjoko Krstic · Published 2023-04-29 · Updated 2023-12-29 · CVE-2023-6929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EuroTel ETL3100 versions v01c01 and v01x37

Description The issue is related to insecure direct object references, which occur when the application provides direct access to objects based on user-supplied input. This allows attackers to bypass authorization, access hidden resources on the system, and execute privileged functionalities. The vulnerability can be exploited by using a user-controlled key to bypass security restrictions, resulting in unauthorized access to protected information and elevated privileges.

Recommendations For EuroTel ETL3100 versions v01c01 and v01x37, consider restricting access to sensitive resources and functionalities to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the application's ability to provide direct access to objects based on user-supplied input.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2023-09003

CVE-2023-6929

Affected Products

Eurotel Etl3100

References · 12

• https://bdu.fstec.ru/vul/2023-09003 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6929 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6929 · Vendor Advisory
• https://exploit-db.com/exploits/51685 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5783.php · Note
• https://twitter.com/CVEnew/status/1737252598447550537 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-353-05 · Note
• https://github.com/advisories/GHSA-c3jv-hpf4-4rpw · Note
• https://t.me/cvenotify/64293 · Telegram Post
• https://t.me/cvenotify/65695 · Telegram Post
• https://manualslib.com/manual/2326078/Eurotel-Etl3100-Series.html?page=18#manual · Note
• https://zeroscience.mk/codes/sielfm_idor.txt · Note