CVE-2023-0750
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-311
Ausencia de cifrado en información sensible
Fecha de publicación:
06/04/2023
Última modificación:
07/11/2023
Descripción
*** Pendiente de traducción *** Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication.<br />
<br />
<br />
<br />
<br />
This would allow an attacker to : <br />
- Change the password, resulting in a DOS of the users<br />
<br />
- Change the streaming source, compromising the integrity of the stream<br />
<br />
- Change the streaming destination, compromising the confidentiality of the stream<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:o:lynx-technik:yellobrik_pec_1864_firmware:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:lynx-technik:yellobrik_pec_1864:-:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página