Lucene search
CERTVDECVELIST:CVE-2023-1083HistoryApr 09, 2024 - 8:25 a.m.
CVE-2023-1083 Welotec: improper access control in TK500v1 router series
2024-04-0908:25:46
CWE-284
CERTVDE
www.cve.org
1
access control
welotec tk500v1
remote attacker
mqtt
configuration commands
reboot commands
firmware updates
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.9
Confidence
High
EPSS
0.001
Percentile
39.1%
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "TK515L",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK515L Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK515L-W",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK515L-W Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525L",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525L Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525L-W",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525L-W Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525U",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525U Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525W",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK525W Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK535L1",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TK535L1 Set",
"vendor": "Welotec",
"versions": [
{
"lessThan": "v2.3.0.r5542",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
]References
Related
nessus
nessus
Welotec Industrial Routers Improper Access Control (CVE-2023-1083)
2024-07-01 00:00:00
vulnrichment
vulnrichment
CVE-2023-1083 Welotec: improper access control in TK500v1 router series
2024-04-09 08:25:46
nvd
nvd
CVE-2023-1083
2024-04-09 09:15:19
cve
cve
CVE-2023-1083
2024-04-09 09:15:19
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.9
Confidence
High
EPSS
0.001
Percentile
39.1%
Related for CVELIST:CVE-2023-1083