HIGH🇬🇧 English

CVE-2023-32347

CVSS 8.1v3.1pub. 2023-05-22upd. 2024-11-21

Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, they could authenticate as that device and steal communication credentials of the device. This could allow an attacker to enable arbitrary command execution as root by utilizing management options within the newly registered devices.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

  • Teltonika Remote Management System

    APP
    Teltonika
    < 4.10.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2023-2586CRITICAL9.0ten sam produkt

Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering pr...

CVE-2023-2587HIGH7.5ten sam produkt

Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerabil...

CVE-2023-2588HIGH8.8ten sam produkt

Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed...

CVE-2023-32346MEDIUM5.3ten sam produkt

Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim t...

CVE-2023-32348MEDIUM5.8ten sam produkt

Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub fea...