CVE-2023-46381

Katalog CVE

CVSS 8.2 · High EPSS 7,4%

Kerentanan Missing Authentication for Critical Function pada loytec linx-212 firmware, loytec lvis-3me12-a1 firmware +1 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.

Rincian

Terbit di NVD

4 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

7,4% peluang dieksploitasi; lebih tinggi dari 94,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthent... advisory pihak ketiga
• https://seclists.org/fulldisclosure/2023/Nov/0 mailing list · advisory pihak ketiga
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
• https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-n...
• http://seclists.org/fulldisclosure/2023/Nov/0