VulnerabilityModified
CVE-2023-45317
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.
HIGH 8.8EPSS 0.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- sielco/analog fm transmitter exc5000gx firmware · sielco/analog fm transmitter exc120gx firmware · sielco/analog fm transmitter exc300gx firmware · sielco/analog fm transmitter exc1600gx firmware · sielco/analog fm transmitter exc2000gx firmware · sielco/analog fm transmitter exc1000gx firmware · sielco/analog fm transmitter exc3000gx firmware · sielco/analog fm transmitter exc30gt firmware · sielco/analog fm transmitter exc300gt firmware · sielco/analog fm transmitter exc100gt firmware · sielco/analog fm transmitter exc5000gt firmware · sielco/analog fm transmitter exc1000gt firmware · sielco/analog fm transmitter exc120gt firmware · sielco/radio link rtx19 firmware · sielco/radio link exc19 firmware
- Source
- ics-cert@hq.dhs.gov
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08Third Party Advisory, US Government Resource
- https://www.sielco.org/en/contactsProduct
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08Third Party Advisory, US Government Resource
- https://www.sielco.org/en/contactsProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.