CVE-2023-46723
lte-pic32-writer's sendto.txt may disclose URL and the API key
- State
- Published
- Severity
- 8.9 High
- Published
- Oct 31, 2023
- Updated
- Sep 5, 2024
- Reserved
- Oct 25, 2023
Description
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.9 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | GitHub_M |
Weaknesses
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Products
| Product | Versions |
|---|---|
lte-pic32-writerpaijp |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.