CVE-2023-42769

Summary

The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.

Affected Software

VendorProductVersion RangeStatus
SielcoAnalog FM transmitter2.12 (EXC5000GX)affected
SielcoAnalog FM transmitter2.12 (EXC120GX)affected
SielcoAnalog FM transmitter2.11 (EXC300GX)affected
SielcoAnalog FM transmitter2.10 (EXC1600GX)affected
SielcoAnalog FM transmitter2.10 (EXC2000GX)affected
SielcoAnalog FM transmitter2.08 (EXC1600GX)affected
SielcoAnalog FM transmitter2.08 (EXC1000GX)affected
SielcoAnalog FM transmitter2.07 (EXC3000GX)affected
SielcoAnalog FM transmitter2.06 (EXC5000GX)affected
SielcoAnalog FM transmitter1.7.7 (EXC30GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC300GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC100GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC5000GT)affected
SielcoAnalog FM transmitter1.6.3 (EXC1000GT)affected
SielcoAnalog FM transmitter1.5.4 (EXC120GT)affected
SielcoRadio Link2.06 (RTX19)affected
SielcoRadio Link2.05 (RTX19)affected
SielcoRadio Link2.00 (EXC19)affected
SielcoRadio Link1.60 (RTX19)affected
SielcoRadio Link1.59 (RTX19)affected
SielcoRadio Link1.55 (EXC19)affected

Weaknesses

  • CWE-284: CWE-284 Improper Access Control

Workarounds

Sielco has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of Sielco PolyEco FM Transmitter are invited to contact Sielco customer support https://www.sielco.org/en/contacts  for additional information.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References