CVE-2023-6930

EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::*
	cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::*

cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*

History

29 Dec 2023, 16:33

Type	Values Removed	Values Added
Summary		(es) EuroTel ETL3100 versiones v01c01 y v01x37 sufren de una configuración no autenticada y una vulnerabilidad de descarga de registros. Esto permite al atacante revelar información confidencial y ayudar a evitar la autenticación, escalar privilegios y acceder completamente al sistema.
CVSS	v2 : ~~unknown~~ v3 : ~~9.4~~	v2 : unknown v3 : 9.8
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05 - Third Party Advisory, US Government Resource
CPE		cpe:2.3:o:eurotel:etl3100_firmware:01c01:::::::* cpe:2.3:o:eurotel:etl3100_firmware:01x37:::::::* cpe:2.3:h:eurotel:etl3100:-:::::::*
First Time		Eurotel etl3100 Firmware Eurotel etl3100 Eurotel
CWE		NVD-CWE-Other

19 Dec 2023, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-19 23:15

Updated : 2023-12-29 16:33

NVD link : CVE-2023-6930

Mitre link : CVE-2023-6930

CVE.ORG link : CVE-2023-6930

JSON object : View

Products Affected

eurotel

etl3100_firmware
etl3100

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2023-6930", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 3.9}]}, "published": "2023-12-19T23:15:08.410", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "\n\n\n\n\n\n\n\n\nEuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.\n\n\n\n\n\n\n\n\n\n\n"}, {"lang": "es", "value": "EuroTel ETL3100 versiones v01c01 y v01x37 sufren de una configuraci\u00f3n no autenticada y una vulnerabilidad de descarga de registros. Esto permite al atacante revelar informaci\u00f3n confidencial y ayudar a evitar la autenticaci\u00f3n, escalar privilegios y acceder completamente al sistema."}], "lastModified": "2023-12-29T16:33:50.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01c01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E14B60DA-34A0-479A-B2FA-7055A70130C5"}, {"criteria": "cpe:2.3:o:eurotel:etl3100_firmware:01x37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0489194-32E5-485A-A8A5-BE1ECEEB004C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eurotel:etl3100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7A6661C9-6751-4E03-9FB8-0406FFE752BA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}