title: Improper Access Control in EuroTel ETL3100
description:
EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.
problem types:  CWE-284 Improper Access Control
affected:
{
defaultStatus: unaffected
product: ETL3100
vendor: EuroTel
versions:
status: affected, version: v01c01
status: affected, version: v01x37
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL