CVE-2023-46664 — HIGH (7.5)

Vulnerability Description

Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Sielco	Polyeco500 Firmware	1.7.0
Sielco	Polyeco500	-
Sielco	Polyeco300 Firmware	2.0.0
Sielco	Polyeco300	-
Sielco	Polyeco1000 Firmware	1.9.3
Sielco	Polyeco1000	-

Related Weaknesses (CWE)

CWE-284

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07Third Party AdvisoryUS Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07Third Party AdvisoryUS Government Resource

FAQ

What is CVE-2023-46664?

CVE-2023-46664 is a vulnerability with a CVSS score of 7.5 (HIGH). Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulne...

How severe is CVE-2023-46664?

CVE-2023-46664 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-46664?

Check the references section above for vendor advisories and patch information. Affected products include: Sielco Polyeco500 Firmware, Sielco Polyeco500, Sielco Polyeco300 Firmware, Sielco Polyeco300, Sielco Polyeco1000 Firmware.