CVE-2023-6928

EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05	Third Party Advisory US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::*
	cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::*

cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:44

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 - Third Party Advisory, US Government Resource

29 Dec 2023, 16:36

Type	Values Removed	Values Added
First Time		Eurotel etl3100 Eurotel etl3100 Firmware Eurotel
CPE		cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::* cpe:2.3:h:eurotel:etl3100:-:::::::* cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::*
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 - Third Party Advisory, US Government Resource
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-307

20 Dec 2023, 13:50

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-19 23:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6928

Mitre link : CVE-2023-6928

CVE.ORG link : CVE-2023-6928

JSON object : View

Products Affected

eurotel

etl3100
etl3100_firmware

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2023-6928", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-12-19T23:15:08.020", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "\nEuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.\n\n\n\n\n"}, {"lang": "es", "value": "EuroTel ETL3100 versiones v01c01 y v01x37 no limitan la cantidad de intentos de adivinar credenciales administrativas en ataques remotos de contrase\u00f1as para obtener el control total del sistema."}], "lastModified": "2024-11-21T08:44:51.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01c01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E14B60DA-34A0-479A-B2FA-7055A70130C5"}, {"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01x37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0489194-32E5-485A-A8A5-BE1ECEEB004C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7A6661C9-6751-4E03-9FB8-0406FFE752BA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}