Description
The application suffers from improper access control when editing users.
A user with read permissions can manipulate users, passwords, and
permissions by sending a single HTTP POST request with modified
parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sielco | Analog FM transmitter | 2.12 (EXC5000GX), 2.12 (EXC120GX), 2.11 (EXC300GX), 2.10 (EXC1600GX), 2.10 (EXC2000GX), 2.08 (EXC1600GX), 2.08 (EXC1000GX), 2.07 (EXC3000GX), 2.06 (EXC5000GX), 1.7.7 (EXC30GT), 1.7.4 (EXC300GT), 1.7.4 (EXC100GT), 1.7.4 (EXC5000GT), 1.6.3 (EXC1000GT), 1.5.4 (EXC120GT) | — |
| Sielco | Radio Link | 2.06 (RTX19), 2.05 (RTX19), 2.00 (EXC19), 1.60 (RTX19), 1.59 (RTX19), 1.55 (EXC19) | — |
Advisories 1
- ICSA-23-299-08 Sielco Radio Link and Analog FM Transmitters CISA ICS & IT advisories · Oct 26, 2023