CVE-2023-41966

Summary

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter.

Affected Software

VendorProductVersion RangeStatus
SielcoAnalog FM transmitter2.12 (EXC5000GX)affected
SielcoAnalog FM transmitter2.12 (EXC120GX)affected
SielcoAnalog FM transmitter2.11 (EXC300GX)affected
SielcoAnalog FM transmitter2.10 (EXC1600GX)affected
SielcoAnalog FM transmitter2.10 (EXC2000GX)affected
SielcoAnalog FM transmitter2.08 (EXC1600GX)affected
SielcoAnalog FM transmitter2.08 (EXC1000GX)affected
SielcoAnalog FM transmitter2.07 (EXC3000GX)affected
SielcoAnalog FM transmitter2.06 (EXC5000GX)affected
SielcoAnalog FM transmitter1.7.7 (EXC30GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC300GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC100GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC5000GT)affected
SielcoAnalog FM transmitter1.6.3 (EXC1000GT)affected
SielcoAnalog FM transmitter1.5.4 (EXC120GT)affected
SielcoRadio Link2.06 (RTX19)affected
SielcoRadio Link2.05 (RTX19)affected
SielcoRadio Link2.00 (EXC19)affected
SielcoRadio Link1.60 (RTX19)affected
SielcoRadio Link1.59 (RTX19)affected
SielcoRadio Link1.55 (EXC19)affected

Weaknesses

  • CWE-267: CWE-267 Privilege Defined With Unsafe Actions

Workarounds

Sielco has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of Sielco PolyEco FM Transmitter are invited to contact Sielco customer support https://www.sielco.org/en/contacts  for additional information.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References