CVE-2023-46385

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46385

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

L

OYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.

References
Link Resource
https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html Third Party Advisory VDB Entry
https://seclists.org/fulldisclosure/2023/Nov/6 Mailing List Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
http://seclists.org/fulldisclosure/2023/Nov/6
https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html Third Party Advisory VDB Entry
https://seclists.org/fulldisclosure/2023/Nov/6 Mailing List Third Party Advisory
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
Configurations

Configuration 1 (hide)

cpe:2.3:a:loytec:l-inx_configurator:7.4.10:*:*:*:*:*:*:*
History

04 Nov 2025, 20:17

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2023/Nov/6 -

21 Nov 2024, 08:28

Type Values Removed Values Added
References () https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html - Third Party Advisory, VDB Entry () https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html - Third Party Advisory, VDB Entry
References () https://seclists.org/fulldisclosure/2023/Nov/6 - Mailing List, Third Party Advisory () https://seclists.org/fulldisclosure/2023/Nov/6 - Mailing List, Third Party Advisory
References () https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/ - () https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/ -

20 Sep 2024, 17:15

Type Values Removed Values Added
References
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01 -
Summary (en) LOYTEC electronics GmbH LINX Configurator 7.4.10 is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration. (en) LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.
Information

Published : 2023-11-30 23:15

Updated : 2025-11-04 20:17

NVD link : CVE-2023-46385

Mitre link : CVE-2023-46385

CVE.ORG link : CVE-2023-46385

JSON object : View

Products Affected

loytec

CWE
CWE-319

Cleartext Transmission of Sensitive Information