CVE-2023-35830

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35830
STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf Vendor Advisory
https://www.stw-mobile-machines.com/psirt/ Vendor Advisory
https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf Vendor Advisory
https://www.stw-mobile-machines.com/psirt/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.01r1:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.02r0:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.03r0:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.04r2:*:*:*:*:*:*:*
cpe:2.3:h:stw-mobile-machines:tcg-4:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:stw-mobile-machines:tcg-4lite_firmware:3.04r2:*:*:*:*:*:*:*
cpe:2.3:h:stw-mobile-machines:tcg-4lite:-:*:*:*:*:*:*:*
History

27 Nov 2024, 17:15

Type Values Removed Values Added
CWE CWE-306

21 Nov 2024, 08:08

Type Values Removed Values Added
References () https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf - Vendor Advisory () https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf - Vendor Advisory
References () https://www.stw-mobile-machines.com/psirt/ - Vendor Advisory () https://www.stw-mobile-machines.com/psirt/ - Vendor Advisory

11 Jul 2023, 19:25

Type Values Removed Values Added
First Time Stw-mobile-machines
Stw-mobile-machines tcg-4
Stw-mobile-machines tcg-4lite
Stw-mobile-machines tcg-4 Firmware
Stw-mobile-machines tcg-4lite Firmware
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.02r0:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.01r1:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.04r2:*:*:*:*:*:*:*
cpe:2.3:h:stw-mobile-machines:tcg-4lite:-:*:*:*:*:*:*:*
cpe:2.3:h:stw-mobile-machines:tcg-4:-:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4lite_firmware:3.04r2:*:*:*:*:*:*:*
cpe:2.3:o:stw-mobile-machines:tcg-4_firmware:3.03r0:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References (MISC) https://www.stw-mobile-machines.com/psirt/ - (MISC) https://www.stw-mobile-machines.com/psirt/ - Vendor Advisory
References (MISC) https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf - (MISC) https://www.stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf - Vendor Advisory

29 Jun 2023, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-29 16:15

Updated : 2024-11-27 17:15

NVD link : CVE-2023-35830

Mitre link : CVE-2023-35830

CVE.ORG link : CVE-2023-35830

JSON object : View

Products Affected

stw-mobile-machines

  • tcg-4lite
  • tcg-4lite_firmware
  • tcg-4_firmware
  • tcg-4
CWE
NVD-CWE-noinfo CWE-306

Missing Authentication for Critical Function