CVE-2023-45228

Summary

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.

Affected Software

VendorProductVersion RangeStatus
SielcoAnalog FM transmitter2.12 (EXC5000GX)affected
SielcoAnalog FM transmitter2.12 (EXC120GX)affected
SielcoAnalog FM transmitter2.11 (EXC300GX)affected
SielcoAnalog FM transmitter2.10 (EXC1600GX)affected
SielcoAnalog FM transmitter2.10 (EXC2000GX)affected
SielcoAnalog FM transmitter2.08 (EXC1600GX)affected
SielcoAnalog FM transmitter2.08 (EXC1000GX)affected
SielcoAnalog FM transmitter2.07 (EXC3000GX)affected
SielcoAnalog FM transmitter2.06 (EXC5000GX)affected
SielcoAnalog FM transmitter1.7.7 (EXC30GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC300GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC100GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC5000GT)affected
SielcoAnalog FM transmitter1.6.3 (EXC1000GT)affected
SielcoAnalog FM transmitter1.5.4 (EXC120GT)affected
SielcoRadio Link2.06 (RTX19)affected
SielcoRadio Link2.05 (RTX19)affected
SielcoRadio Link2.00 (EXC19)affected
SielcoRadio Link1.60 (RTX19)affected
SielcoRadio Link1.59 (RTX19)affected
SielcoRadio Link1.55 (EXC19)affected

Weaknesses

  • CWE-284: CWE-284 Improper Access Control

Workarounds

Sielco has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of Sielco PolyEco FM Transmitter are invited to contact Sielco customer support https://www.sielco.org/en/contacts  for additional information.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References