Lucene search

[email protected]CVE-2023-46663

HistoryOct 26, 2023 - 9:15 p.m.

CVE-2023-46663

2023-10-2621:15:07

CWE-284

[email protected]

web.nvd.nist.gov

sielco polyeco1000

cve-2023-46663

authorization bypass

vulnerability

http requests

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.

Affected configurations

NVD

Node

sielcopolyeco500_firmwareMatch1.7.0cpu

sielcopolyeco500_firmwareMatch10.16fpga

AND

sielcopolyeco500Match-

Node

sielcopolyeco300_firmwareMatch2.0.0cpu

sielcopolyeco300_firmwareMatch2.0.2cpu

sielcopolyeco300_firmwareMatch10.19fpga

AND

sielcopolyeco300Match-

Node

sielcopolyeco1000_firmwareMatch1.9.3cpu

sielcopolyeco1000_firmwareMatch1.9.4cpu

sielcopolyeco1000_firmwareMatch2.0.6cpu

sielcopolyeco1000_firmwareMatch10.19fpga

AND

sielcopolyeco1000Match-

CPENameOperatorVersion
sielco:polyeco500_firmwaresielco polyeco500 firmwareeq1.7.0
sielco:polyeco500_firmwaresielco polyeco500 firmwareeq10.16

CPE	Name	Operator	Version
sielco:polyeco500_firmware	sielco polyeco500 firmware	eq	1.7.0
sielco:polyeco500_firmware	sielco polyeco500 firmware	eq	10.16

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PolyEco1000",
    "vendor": "Sielco ",
    "versions": [
      {
        "status": "affected",
        "version": "CPU:2.0.6 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.4 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.3 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.7.0 FPGA:10.16"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.2 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.0 FPGA:10.19"
      }
    ]
  }
]