title: Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe Actions
description:
The application suffers from a privilege escalation vulnerability. A
user with read permissions can elevate privileges by sending a HTTP POST
to set a parameter.
problem types: CWE-267 Privilege Defined With Unsafe Actions
affected:
{
defaultStatus: unaffected
product: Analog FM transmitter
vendor: Sielco
versions:
status: affected, version: 2.12 (EXC5000GX)
status: affected, version: 2.12 (EXC120GX)
status: affected, version: 2.11 (EXC300GX)
status: affected, version: 2.10 (EXC1600GX)
status: affected, version: 2.10 (EXC2000GX)
status: affected, version: 2.08 (EXC1600GX)
status: affected, version: 2.08 (EXC1000GX)
status: affected, version: 2.07 (EXC3000GX)
status: affected, version: 2.06 (EXC5000GX)
status: affected, version: 1.7.7 (EXC30GT)
status: affected, version: 1.7.4 (EXC300GT)
status: affected, version: 1.7.4 (EXC100GT)
status: affected, version: 1.7.4 (EXC5000GT)
status: affected, version: 1.6.3 (EXC1000GT)
status: affected, version: 1.5.4 (EXC120GT)
}
{
defaultStatus: unaffected
product: Radio Link
vendor: Sielco
versions:
status: affected, version: 2.06 (RTX19)
status: affected, version: 2.05 (RTX19)
status: affected, version: 2.00 (EXC19)
status: affected, version: 1.60 (RTX19)
status: affected, version: 1.59 (RTX19)
status: affected, version: 1.55 (EXC19)
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: Sielco has not responded to requests to work with CISA to mitigate these
vulnerabilities. Users of affected versions of Sielco PolyEco FM
Transmitter are invited to contact Sielco  customer support https://www.sielco.org/en/contacts  for additional information.