title: Sielco Radio Link and Analog FM Transmitters Cross-Site Request Forgery
description:
The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with
administrative privileges if a logged-in user visits a malicious web
site.
problem types: CWE-352 Cross-Site Request Forgery
affected:
{
defaultStatus: unaffected
product: Analog FM transmitter
vendor: Sielco
versions:
status: affected, version: 2.12 (EXC5000GX)
status: affected, version: 2.12 (EXC120GX)
status: affected, version: 2.11 (EXC300GX)
status: affected, version: 2.10 (EXC1600GX)
status: affected, version: 2.10 (EXC2000GX)
status: affected, version: 2.08 (EXC1600GX)
status: affected, version: 2.08 (EXC1000GX)
status: affected, version: 2.07 (EXC3000GX)
status: affected, version: 2.06 (EXC5000GX)
status: affected, version: 1.7.7 (EXC30GT)
status: affected, version: 1.7.4 (EXC300GT)
status: affected, version: 1.7.4 (EXC100GT)
status: affected, version: 1.7.4 (EXC5000GT)
status: affected, version: 1.6.3 (EXC1000GT)
status: affected, version: 1.5.4 (EXC120GT)
}
{
defaultStatus: unaffected
product: Radio Link
vendor: Sielco
versions:
status: affected, version: 2.06 (RTX19)
status: affected, version: 2.05 (RTX19)
status: affected, version: 2.00 (EXC19)
status: affected, version: 1.60 (RTX19)
status: affected, version: 1.59 (RTX19)
status: affected, version: 1.55 (EXC19)
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: Sielco has not responded to requests to work with CISA to mitigate these
vulnerabilities. Users of affected versions of Sielco PolyEco FM
Transmitter are invited to contact Sielco  customer support https://www.sielco.org/en/contacts  for additional information.