CVE-2023-45317

Summary

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

Affected Software

VendorProductVersion RangeStatus
SielcoAnalog FM transmitter2.12 (EXC5000GX)affected
SielcoAnalog FM transmitter2.12 (EXC120GX)affected
SielcoAnalog FM transmitter2.11 (EXC300GX)affected
SielcoAnalog FM transmitter2.10 (EXC1600GX)affected
SielcoAnalog FM transmitter2.10 (EXC2000GX)affected
SielcoAnalog FM transmitter2.08 (EXC1600GX)affected
SielcoAnalog FM transmitter2.08 (EXC1000GX)affected
SielcoAnalog FM transmitter2.07 (EXC3000GX)affected
SielcoAnalog FM transmitter2.06 (EXC5000GX)affected
SielcoAnalog FM transmitter1.7.7 (EXC30GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC300GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC100GT)affected
SielcoAnalog FM transmitter1.7.4 (EXC5000GT)affected
SielcoAnalog FM transmitter1.6.3 (EXC1000GT)affected
SielcoAnalog FM transmitter1.5.4 (EXC120GT)affected
SielcoRadio Link2.06 (RTX19)affected
SielcoRadio Link2.05 (RTX19)affected
SielcoRadio Link2.00 (EXC19)affected
SielcoRadio Link1.60 (RTX19)affected
SielcoRadio Link1.59 (RTX19)affected
SielcoRadio Link1.55 (EXC19)affected

Weaknesses

  • CWE-352: CWE-352 Cross-Site Request Forgery

Workarounds

Sielco has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of Sielco PolyEco FM Transmitter are invited to contact Sielco customer support https://www.sielco.org/en/contacts  for additional information.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References