CVE-2023-46661

🗓️ 26 Oct 2023 19:57:12Reported by icscertType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Sielco PolyEco1000 privilege escalation via password modificatio

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software, due to lack of access control, allows intruders to enhance their privileges and gain unauthorized access to the device.	1 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-46661	27 Oct 202300:18	–	circl
CNNVD	Sielco PolyEco1000 Security Vulnerability	26 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-46661 Improper Access Control in Sielco PolyEco1000	26 Oct 202319:57	–	cvelist
EUVD	EUVD-2023-50852	3 Oct 202520:07	–	euvd
ICS	Sielco PolyEco FM Transmitter	26 Oct 202306:00	–	ics
NVD	CVE-2023-46661	26 Oct 202320:15	–	nvd
OSV	CVE-2023-46661	26 Oct 202320:15	–	osv
Prion	Code injection	26 Oct 202320:15	–	prion
Positive Technologies	PT-2023-6588 · Sielco · Sielco Polyeco1000	26 Oct 202300:00	–	ptsecurity

NVD

Vulners

Node

sielco polyeco500_firmwareMatch1.7.0cpu

sielco polyeco500_firmwareMatch10.16fpga

AND

sielco polyeco500Match-

Node

sielco polyeco300_firmwareMatch2.0.0cpu

sielco polyeco300_firmwareMatch2.0.2cpu

sielco polyeco300_firmwareMatch10.19fpga

AND

sielco polyeco300Match-

Node

sielco polyeco1000_firmwareMatch1.9.3cpu

sielco polyeco1000_firmwareMatch1.9.4cpu

sielco polyeco1000_firmwareMatch2.0.6cpu

sielco polyeco1000_firmwareMatch10.19fpga

AND

sielco polyeco1000Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "PolyEco1000",
    "vendor": "Sielco ",
    "versions": [
      {
        "status": "affected",
        "version": "CPU:2.0.6 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.4 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.3 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.7.0 FPGA:10.16"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.2 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.0 FPGA:10.19"
      }
    ]
  }
]

Source	Link
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-299-07

Parameter	Position	Path	Description	CWE
pwd_admin	request body	RADIOFM/protect/users.htm	Authentication bypass via POST to vulnerable endpoint to modify admin/user passwords and gain admin access.	CWE-284
pwd_user	request body	RADIOFM/protect/users.htm	Authentication bypass via POST to vulnerable endpoint to modify admin/user passwords and gain admin access.	CWE-284

17 Jun 2026 06:31Current

9.5High risk

Vulners AI Score9.5

CVSS 3.19.8

EPSS0.00536

SSVC

CWE-284