CVE-2023-46723 HIGH

CVE-2023-46723: lte-pic32-writer's sendto.txt may disclose URL and the API key

Vendor Paijp
Product lte-pic32-writer
Weakness CWE-538
Published October 31, 2023
Last update September 5, 2024

CVSS base score

8.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.

Key dates

02Disclosure timeline

October 31, 2023 CVE published
September 5, 2024 Record updated