CVE-2023-46663

HIGH

Sielco PolyEco1000 - Improper Access Control via Unauthorized HTTP Requests

Title source: llm

Description

Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.

References (1)

Core 1

Core References

Third Party Advisory, US Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07

Scores

CVSS v3 7.5

EPSS 0.0044

EPSS Percentile 35.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (9)

sielco/polyeco1000_firmware 1.9.3

sielco/polyeco1000_firmware 1.9.4

sielco/polyeco1000_firmware 2.0.6

sielco/polyeco1000_firmware 10.19

sielco/polyeco300_firmware 2.0.0

sielco/polyeco300_firmware 2.0.2

sielco/polyeco300_firmware 10.19

sielco/polyeco500_firmware 1.7.0

sielco/polyeco500_firmware 10.16

Published Oct 26, 2023

Tracked Since Feb 18, 2026