Improper access control in Sielco products - CVE-2023-42769

Vulnerability identifier: #VU82526

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-42769

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can perform a brute-force attack to obtain a valid session, bypass authentication and manipulate the transmitter.

Analog FM transmitter: EXC120GT
Analog FM transmitter EXC1000GT
Analog FM transmitter EXC5000GT
Analog FM transmitter EXC100GT
Analog FM transmitter EXC300GT
Analog FM transmitter EXC30GT
Radio Link EXC19
Radio Link RTX19
Analog FM transmitter EXC5000GX
Analog FM transmitter EXC3000GX
Analog FM transmitter EXC1000GX
Analog FM transmitter EXC1600GX
Analog FM transmitter EXC2000GX
Analog FM transmitter EXC300GX
Analog FM transmitter EXC120GX

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://www.sielco.org/en/contacts
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08

• Multiple vulnerabilities in Sielco Radio Link and Analog FM Transmitters