CVE-2023-6928

EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::*
	cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::*

cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*

History

29 Dec 2023, 16:36

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 - Third Party Advisory, US Government Resource
Summary		(es) EuroTel ETL3100 versiones v01c01 y v01x37 no limitan la cantidad de intentos de adivinar credenciales administrativas en ataques remotos de contraseñas para obtener el control total del sistema.
First Time		Eurotel etl3100 Firmware Eurotel etl3100 Eurotel
CPE		cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::* cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::* cpe:2.3:h:eurotel:etl3100:-:::::::*

19 Dec 2023, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-19 23:15

Updated : 2023-12-29 16:36

NVD link : CVE-2023-6928

Mitre link : CVE-2023-6928

CVE.ORG link : CVE-2023-6928

JSON object : View

Products Affected

eurotel

etl3100
etl3100_firmware

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2023-6928", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-12-19T23:15:08.020", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "\nEuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.\n\n\n\n\n"}, {"lang": "es", "value": "EuroTel ETL3100 versiones v01c01 y v01x37 no limitan la cantidad de intentos de adivinar credenciales administrativas en ataques remotos de contrase\u00f1as para obtener el control total del sistema."}], "lastModified": "2023-12-29T16:36:03.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01c01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E14B60DA-34A0-479A-B2FA-7055A70130C5"}, {"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01x37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0489194-32E5-485A-A8A5-BE1ECEEB004C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7A6661C9-6751-4E03-9FB8-0406FFE752BA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}