CVE-2023-0897

🗓️ 26 Oct 2023 19:44:01Reported by icscertType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

Sielco PolyEco1000 session hijack vulnerability due to cookie brute force attac

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software, related to improper session management, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	1 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-0897	27 Oct 202300:18	–	circl
CNNVD	Sielco PolyEco1000 授权问题漏洞	25 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-0897 Session FIxation in Sielco PolyEco1000	26 Oct 202319:44	–	cvelist
EUVD	EUVD-2023-12886	3 Oct 202520:07	–	euvd
ICS	Sielco PolyEco FM Transmitter	26 Oct 202306:00	–	ics
NVD	CVE-2023-0897	26 Oct 202320:15	–	nvd
OSV	CVE-2023-0897	26 Oct 202320:15	–	osv
Prion	Session fixation	26 Oct 202320:15	–	prion
Positive Technologies	PT-2023-6586 · Sielco · Sielco Polyeco1000	26 Oct 202300:00	–	ptsecurity

NVD

Vulners

Node

AND

sielco polyeco500_firmwareMatch1.7.0cpu

sielco polyeco500_firmwareMatch10.16fpga

sielco polyeco500Match-

Node

AND

sielco polyeco300_firmwareMatch2.0.0cpu

sielco polyeco300_firmwareMatch2.0.2cpu

sielco polyeco300_firmwareMatch10.19fpga

sielco polyeco300Match-

Node

AND

sielco polyeco1000_firmwareMatch1.9.3cpu

sielco polyeco1000_firmwareMatch1.9.4cpu

sielco polyeco1000_firmwareMatch2.0.6cpu

sielco polyeco1000_firmwareMatch10.19fpga

sielco polyeco1000Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "PolyEco1000",
    "vendor": "Sielco ",
    "versions": [
      {
        "status": "affected",
        "version": "CPU:2.0.6 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.4 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.3 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.7.0 FPGA:10.16"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.2 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.0 FPGA:10.19"
      }
    ]
  }
]

Source	Link
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-299-07

Parameter	Position	Path	Description	CWE
user	query param	RADIOFM/login.cgi	Session hijacking due to brute-forcible session cookie and lack of SSL, with session visible in HTTP requests.	CWE-384
password	query param	RADIOFM/login.cgi	Session hijacking due to brute-forcible session cookie and lack of SSL, with session visible in HTTP requests.	CWE-384
id	query param	RADIOFM/login.cgi	Session hijacking due to brute-forcible session cookie and lack of SSL, with session visible in HTTP requests.	CWE-384

17 Jun 2026 05:26Current

9.2High risk

Vulners AI Score9.2

CVSS 3.18.8 - 9.8

EPSS0.00469

SSVC

CWE-384