PT-2024-12770 · Multilaser · Multilaser Re160

Vinícius Moraes · Published 2024-03-02 · Updated 2025-01-07 · CVE-2023-38946

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multilaser RE160 firmware versions 5.07.51 pt MTL01 through 5.07.52 pt MTL01

Description The issue allows attackers to bypass access control and gain complete access to the application by supplying a crafted cookie. This enables attackers to manipulate the cookie and gain unauthorized access.

Recommendations For versions 5.07.51 pt MTL01 and 5.07.52 pt MTL01, consider restricting access to the application until a patch is available. As a temporary workaround, avoid using the vulnerable cookie manipulation feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-38946

Affected Products

Multilaser Re160

References · 9

• 🔥 http://seclists.org/fulldisclosure/2024/Mar/2 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38946 · Security Note
• https://twitter.com/VulmonFeeds/status/1764099860255457724 · Twitter Post
• https://t.me/cvenotify/73086 · Telegram Post
• https://twitter.com/Esparta6108713/status/1764096755665371178 · Twitter Post
• https://twitter.com/buaqbot/status/1764110526752194846 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1764100113239036077 · Twitter Post
• https://twitter.com/CVEnew/status/1765180858703491576 · Twitter Post