Lucene search

MitreCVE-2023-33534

HistoryJul 31, 2023 - 2:15 p.m.

CVE-2023-33534

2023-07-3114:15:10

CWE-352

mitre

web.nvd.nist.gov

cve-2023-33534

cross-site request forgery

csrf

guanzhou tozed kangwei

zlts10g

security vulnerability

software security

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goform_set_cmd_process.

Affected configurations

Nvd

Node

sztozedzlt_s10g_firmwareMatch3.11.6

AND

sztozedzlt_s10gMatch-

VendorProductVersionCPE
sztozedzlt_s10g_firmware3.11.6cpe:2.3:o:sztozed:zlt_s10g_firmware:3.11.6:*:*:*:*:*:*:*
sztozedzlt_s10g-cpe:2.3:h:sztozed:zlt_s10g:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sztozed	zlt_s10g_firmware	3.11.6	cpe:2.3:o:sztozed:zlt_s10g_firmware:3.11.6:::::::*
sztozed	zlt_s10g	-	cpe:2.3:h:sztozed:zlt_s10g:-:::::::*

References

rodelllemit.medium.com/cve-2023-33534-account-takeover-through-csrf-vulnerability-461de6f1b696

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVE-2023-33534