CVE-2023-2586

CRITICAL

9.0

Description

Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS).

CVE Details

CVSS v3.1 Score9.0

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

Published5/22/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

teltonika:remote_management_system

Weaknesses (CWE)

CWE-287

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.