CSRF in Sielco Analog Fm Transmitter
CVE-2023-45317
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (15.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Sielco Analog Fm Transmitter — versions 2.12 (EXC5000GX), 2.12 (EXC120GX), 2.11 (EXC300GX)
- Sielco Analog_fm_transmitter_exc1000gt — versions 1.6.3
- Sielco Analog_fm_transmitter_exc1000gt_firmware
- Sielco Analog_fm_transmitter_exc1000gx — versions 2.08
- Sielco Analog_fm_transmitter_exc1000gx_firmware
- Sielco Analog_fm_transmitter_exc100gt — versions 1.7.4
- Sielco Analog_fm_transmitter_exc100gt_firmware
- Sielco Analog_fm_transmitter_exc120gt — versions 1.5.4
- Sielco Analog_fm_transmitter_exc120gt_firmware
- Sielco Analog_fm_transmitter_exc120gx — versions 2.12
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory)
- ics-cert@hq.dhs.gov (Product)
Frequently asked questions
- What is CVE-2023-45317?
- CVE-2023-45317 is a high-severity vulnerability in Sielco Analog Fm Transmitter, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2023-10-26.
- How severe is CVE-2023-45317?
- High severity. CVSS v3 base score is 8.8 out of 10.