CVE-2023-38945
Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the application via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the application via supplying a crafted URL.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- multilaser/re160 firmware · multilaser/re160v firmware · multilaser/re163v firmware
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2024/Mar/1Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Mar/1Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Mar/2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.