CVE-2023-46661 - Vulnerability Details - OpenCVE

Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Sielco	Polyeco1000 Polyeco1000 Firmware Polyeco300 Polyeco300 Firmware Polyeco500 Polyeco500 Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:sielco:polyeco500_firmware:1.7.0::::cpu:::
	cpe:2.3:o:sielco:polyeco500_firmware:10.16::::fpga:::

cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:sielco:polyeco300_firmware:2.0.0::::cpu:::
	cpe:2.3:o:sielco:polyeco300_firmware:2.0.2::::cpu:::
	cpe:2.3:o:sielco:polyeco300_firmware:10.19::::fpga:::

cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:10.19::::fpga:::

cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07

History

Thu, 16 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-10-26T19:57:12.046Z

Updated: 2025-01-16T21:27:31.395Z

Reserved: 2023-10-24T16:27:17.281Z

Link: CVE-2023-46661

Vulnrichment

Updated: 2024-08-02T20:53:21.079Z

NVD

Status : Modified

Published: 2023-10-26T20:15:08.717

Modified: 2024-11-21T08:29:00.397

Link: CVE-2023-46661

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46661", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-10-24T16:27:17.281Z", "datePublished": "2023-10-26T19:57:12.046Z", "dateUpdated": "2025-01-16T21:27:31.395Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PolyEco1000", "vendor": "Sielco ", "versions": [{"status": "affected", "version": "CPU:2.0.6 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.4 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.3 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.7.0 FPGA:10.16"}, {"status": "affected", "version": "CPU:2.0.2 FPGA:10.19"}, {"status": "affected", "version": "CPU:2.0.0 FPGA:10.19"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Gjoko Krstic"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.</p><br>\n\n"}], "value": "\nSielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-10-26T19:57:12.046Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Access Control in Sielco PolyEco1000", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:53:21.079Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T21:22:27.511840Z", "id": "CVE-2023-46661", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:27:31.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:53:21.079Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46661", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-16T21:22:27.511840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:22:28.821Z"}}], "cna": {"title": "Improper Access Control in Sielco PolyEco1000", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Gjoko Krstic"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Sielco ", "product": "PolyEco1000", "versions": [{"status": "affected", "version": "CPU:2.0.6 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.4 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.3 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.7.0 FPGA:10.16"}, {"status": "affected", "version": "CPU:2.0.2 FPGA:10.19"}, {"status": "affected", "version": "CPU:2.0.0 FPGA:10.19"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.</p><br>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-10-26T19:57:12.046Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46661", "state": "PUBLISHED", "dateUpdated": "2025-01-16T21:27:31.395Z", "dateReserved": "2023-10-24T16:27:17.281Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-10-26T19:57:12.046Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco500_firmware:1.7.0:*:*:*:cpu:*:*:*", "matchCriteriaId": "E64F96A4-542A-486E-AC9A-3EC1E68A6D1E", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco500_firmware:10.16:*:*:*:fpga:*:*:*", "matchCriteriaId": "E3A4049B-D0B2-4CB6-8B31-ECD3BF4FF384", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7E931F0-5608-4F24-821B-3DB29972C077", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:2.0.0:*:*:*:cpu:*:*:*", "matchCriteriaId": "BBA5260D-A7D3-4973-8106-E8C73F50A6CE", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:2.0.2:*:*:*:cpu:*:*:*", "matchCriteriaId": "F7CE9236-A970-49F0-A200-84BC3B77CECB", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:10.19:*:*:*:fpga:*:*:*", "matchCriteriaId": "D45CE1CD-FB47-4FFD-974E-B55B569A5850", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:*", "matchCriteriaId": "05832105-6C9E-4850-A145-F3E241058CCA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3:*:*:*:cpu:*:*:*", "matchCriteriaId": "991B1AD8-671D-4EF9-901B-0834748258F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4:*:*:*:cpu:*:*:*", "matchCriteriaId": "FE961B31-1553-4457-8436-8F9662AA10CA", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6:*:*:*:cpu:*:*:*", "matchCriteriaId": "0BF0380D-483C-4B14-BF42-AC1E9C79D2DE", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:10.19:*:*:*:fpga:*:*:*", "matchCriteriaId": "F0E5773E-8842-4FCB-80BD-266A237042E7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "01DB9D87-6F35-4171-AD59-9B90386F431E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "\nSielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.\n\n\n\n\n"}, {"lang": "es", "value": "Sielco PolyEco1000 es vulnerable a que un atacante incremente sus privilegios modificando contrase\u00f1as en solicitudes POST."}], "id": "CVE-2023-46661", "lastModified": "2024-11-21T08:29:00.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-26T20:15:08.717", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}