CVE-2023-2586
- State
- Published
- Severity
- 9.0 Critical
- Published
- May 22, 2023
- Updated
- Jan 16, 2025
- Reserved
- May 8, 2023
Description
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.0 Critical | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H | icscert |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Remote Management SystemTeltonika |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.