CVE-2023-45228
Assigner: icscert
Published: 2023-10-26T16:19:41.642Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Analog FM transmitter
vendor: Sielco
versions: status: affected
version: 2.12 (EXC5000GX)
status: affected
version: 2.12 (EXC120GX)
status: affected
version: 2.11 (EXC300GX)
status: affected
version: 2.10 (EXC1600GX)
status: affected
version: 2.10 (EXC2000GX)
status: affected
version: 2.08 (EXC1600GX)
status: affected
version: 2.08 (EXC1000GX)
status: affected
version: 2.07 (EXC3000GX)
status: affected
version: 2.06 (EXC5000GX)
status: affected
version: 1.7.7 (EXC30GT)
status: affected
version: 1.7.4 (EXC300GT)
status: affected
version: 1.7.4 (EXC100GT)
status: affected
version: 1.7.4 (EXC5000GT)
status: affected
version: 1.6.3 (EXC1000GT)
status: affected
version: 1.5.4 (EXC120GT)
defaultStatus: unaffected
product: Radio Link
vendor: Sielco 
versions: status: affected
version: 2.06 (RTX19)
status: affected
version: 2.05 (RTX19)
status: affected
version: 2.00 (EXC19)
status: affected
version: 1.60 (RTX19)
status: affected
version: 1.59 (RTX19)
status: affected
version: 1.55 (EXC19)
datePublic: 2023-10-26T16:02:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 


The application suffers from improper access control when editing users.
 A user with read permissions can manipulate users, passwords, and 
permissions by sending a single HTTP POST request with modified 
parameters.






value: 

The application suffers from improper access control when editing users.
 A user with read permissions can manipulate users, passwords, and 
permissions by sending a single HTTP POST request with modified 
parameters.






metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-284
description: CWE-284  Improper Access Control
type: CWE
source: discovery: EXTERNAL
title: Sielco Radio Link and Analog FM Transmitters  Improper Access Control
workarounds: supportingMedia: base64: no
type: text/html
value: 
Sielco has not responded to requests to work with CISA to mitigate these
 vulnerabilities. Users of affected versions of Sielco PolyEco FM 
Transmitter are invited to contact Sielco <a target="_blank" rel="nofollow" href="https://www.sielco.org/en/contacts">customer support</a>&nbsp;for additional information.

<br>
value: Sielco has not responded to requests to work with CISA to mitigate these
 vulnerabilities. Users of affected versions of Sielco PolyEco FM 
Transmitter are invited to contact Sielco  customer support https://www.sielco.org/en/contacts  for additional information.



x_generator: engine: Vulnogram 0.1.0-dev