9.8

CVE-2023-6929

Authorization Bypass Through User-Controlled Key in EuroTel ETL3100





EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the system, and execute privileged functionalities.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eurotel ≫ Etl3100 Firmware Version01c01
   Eurotel ≫ Etl3100 Version-
Eurotel ≫ Etl3100 Firmware Version01x37
   Eurotel ≫ Etl3100 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.519
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ics-cert@hq.dhs.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
Third Party Advisory
US Government Resource