CVE-2023-0750 - Yellowbrik PEC-1864 authentication bypass

Back Back to CVE browser

CRITICAL

Yellowbrik PEC-1864 authentication bypass

Published Apr 6, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.45%

Description

Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication.

This would allow an attacker to : - Change the password, resulting in a DOS of the users

- Change the streaming source, compromising the integrity of the stream

- Change the streaming destination, compromising the confidentiality of the stream

This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.

Affected products

Vendor Lynx Technik AG Product Yellowbrik Default
affected
- Version
  PEC 1864
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lynx Technik AG

Yellowbrik

affected

Version	Status	Constraints
PEC 1864	affected	-

Remediation

Vendor solution

isolate the PEC-1864 behind a firewall disallowing any traffic on the web interface, do not allow access from internet.

Weaknesses (2)

CWE-311

Missing Encryption of Sensitive Data

CWE-602

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12768		Advisory
https://support.lynx-technik.com/support/solutions/articles/1000317081-pec-1864-web-ui-for-configuration		Vendor Advisory