Skip to content
OpenAdvisories
Critical ICSA-23-299-08 4 CVEs

Sielco Radio Link and Analog FM Transmitters

Published Oct 26, 2023 · Updated Oct 26, 2023

Vendor: Sielco Product: Analog FM transmitter (EXC1000GT) Product: Analog FM transmitter (EXC1000GX) Product: Analog FM transmitter (EXC100GT) Product: Analog FM transmitter (EXC120GT) Product: Analog FM transmitter (EXC120GX) Product: Analog FM transmitter (EXC1600GX) Product: Analog FM transmitter (EXC2000GX) Product: Analog FM transmitter (EXC3000GX) Product: Analog FM transmitter (EXC300GT) Product: Analog FM transmitter (EXC300GX) Product: Analog FM transmitter (EXC30GT) Product: Analog FM transmitter (EXC5000GT) Product: Analog FM transmitter (EXC5000GX) Product: Radio Link (EXC19) Product: Radio Link (RTX19)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, access restricted pages, or hijack sessions.

Vulnerabilities 4

  • Critical 9.8
    CVE-2023-42769

    Sielco Radio Link and Analog FM Transmitters Improper Access Control

    The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.

    Sielco Radio Link Analog FM transmitter
  • High 8.8
    CVE-2023-45317

    Sielco Radio Link and Analog FM Transmitters Cross-Site Request Forgery

    The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a mal…

    Sielco Radio Link Analog FM transmitter
  • Medium 6.5
    CVE-2023-41966

    Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe Actions

    The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter.

    Sielco Analog FM transmitter Radio Link
  • Medium 6.5
    CVE-2023-45228

    Sielco Radio Link and Analog FM Transmitters Improper Access Control

    The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.

    Sielco Analog FM transmitter Radio Link

Revision history

  1. #1

    Initial Publication

References