CVE-2023-46385

Опубликовано: 30 нояб. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.

Ссылки

https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2023/Nov/6
Mailing List
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
http://seclists.org/fulldisclosure/2023/Nov/6
https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2023/Nov/6
Mailing List
Third Party Advisory
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:loytec:l-inx_configurator:7.4.10:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00135

Низкий

7.5 High

CVSS3

Дефекты

CWE-319

Связанные уязвимости

GHSA-whp9-r49x-695c