Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, they could authenticate as that device and steal communication credentials of the device. This could allow an attacker to enable arbitrary command execution as root by utilizing management options within the newly registered devices.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 | Third Party Advisory US Government Resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 | Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 08:03
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 - Third Party Advisory, US Government Resource |
31 May 2023, 20:18
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Teltonika remote Management System
Teltonika |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 - Third Party Advisory, US Government Resource | |
| CPE | cpe:2.3:a:teltonika:remote_management_system:*:*:*:*:*:*:*:* |
Information
Published : 2023-05-22 15:15
Updated : 2024-11-21 08:03
NVD link : CVE-2023-32347
Mitre link : CVE-2023-32347
CVE.ORG link : CVE-2023-32347
JSON object : View
Products Affected
teltonika
- remote_management_system
CWE
CWE-287
Improper Authentication