CVE-2023-6929 HIGH

CVE-2023-6929: Authorization Bypass Through User-Controlled Key in EuroTel ETL3100

Vendor Eurotel
Product ETL3100
Weakness CWE-639 · IDOR
Published December 19, 2023
Last update May 6, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the system, and execute privileged functionalities.

Key dates

02Disclosure timeline

December 19, 2023 CVE published
May 6, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-26078 Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint CVE-2026-34046 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check CVE-2025-69030 WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-53911 Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records CVE-2026-1987 Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification