title: Sielco Radio Link and Analog FM Transmitters Improper Access Control
description: The cookie session ID is of insufficient length and can be exploited by
brute force, which may allow a remote attacker to obtain a valid
session, bypass authentication, and manipulate the transmitter.
problem types: CWE-284 Improper Access Control
affected:
{
defaultStatus: unaffected
product: Analog FM transmitter
vendor: Sielco
versions:
status: affected, version: 2.12 (EXC5000GX)
status: affected, version: 2.12 (EXC120GX)
status: affected, version: 2.11 (EXC300GX)
status: affected, version: 2.10 (EXC1600GX)
status: affected, version: 2.10 (EXC2000GX)
status: affected, version: 2.08 (EXC1600GX)
status: affected, version: 2.08 (EXC1000GX)
status: affected, version: 2.07 (EXC3000GX)
status: affected, version: 2.06 (EXC5000GX)
status: affected, version: 1.7.7 (EXC30GT)
status: affected, version: 1.7.4 (EXC300GT)
status: affected, version: 1.7.4 (EXC100GT)
status: affected, version: 1.7.4 (EXC5000GT)
status: affected, version: 1.6.3 (EXC1000GT)
status: affected, version: 1.5.4 (EXC120GT)
}
{
defaultStatus: unaffected
product: Radio Link
vendor: Sielco
versions:
status: affected, version: 2.06 (RTX19)
status: affected, version: 2.05 (RTX19)
status: affected, version: 2.00 (EXC19)
status: affected, version: 1.60 (RTX19)
status: affected, version: 1.59 (RTX19)
status: affected, version: 1.55 (EXC19)
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: Sielco has not responded to requests to work with CISA to mitigate these
vulnerabilities. Users of affected versions of Sielco PolyEco FM
Transmitter are invited to contact Sielco  customer support https://www.sielco.org/en/contacts  for additional information.