CVE-2023-6928

EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*

OR	cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::*
	cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::*

History

No history.

Information

Published : 2023-12-19 23:15

Updated : 2023-12-29 16:36

NVD link : CVE-2023-6928

Mitre link : CVE-2023-6928

CVE.ORG link : CVE-2023-6928

JSON object : View

Products Affected

eurotel

etl3100_firmware
etl3100

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2023-6928", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-12-19T23:15:08.020", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "\nEuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.\n\n\n\n\n"}, {"lang": "es", "value": "EuroTel ETL3100 versiones v01c01 y v01x37 no limitan la cantidad de intentos de adivinar credenciales administrativas en ataques remotos de contrase\u00f1as para obtener el control total del sistema."}], "lastModified": "2023-12-29T16:36:03.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7A6661C9-6751-4E03-9FB8-0406FFE752BA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01c01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E14B60DA-34A0-479A-B2FA-7055A70130C5"}, {"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01x37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0489194-32E5-485A-A8A5-BE1ECEEB004C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}