PT-2024-12286 · Teslamate+1 · Teslamate+1

Published 2024-03-26 · Updated 2024-08-02 · CVE-2023-31634

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeslaMate versions prior to 1.27.2

Description The issue allows unauthorized access to port 4000 for remote viewing and operation of user data. An attacker can access the IP address for the TeslaMate instance, switch the port to 3000 to enter Grafana for remote operations, and use the default username and password to enter the Grafana management console without logging in.

Recommendations For versions prior to 1.27.2, update to version 1.27.2 or later to resolve the issue. As a temporary workaround, consider restricting access to port 4000 and changing the default username and password for the Grafana management console. Restrict access to the Grafana management console to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-31634

Affected Products

Grafana

Teslamate

References · 6

• 🔥 https://github.com/XC9409/CVE-2023-31634/blob/main/PoC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31634 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31634 · Vendor Advisory
• https://github.com/adriankumpf/teslamate/releases/tag/v1.27.2 · Note
• https://twitter.com/CVEnew/status/1772864284604912101 · Twitter Post
• https://t.me/cvenotify/74783 · Telegram Post