Vulnerability · Published May 22, 2023 · Assigned by icscert

CVE-2023-32348

Medium 5.8

In plain English

A medium-severity server-side request forgery in Remote Management System from Teltonika. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The OpenVPN server also allows users to route through it. An attacker could route a connection to a remote server through the OpenVPN server, enabling them to scan and access data from other Teltonika devices connected to the VPN.

Affected products (as reported)

Vendor	Product	Versions
Teltonika	Remote Management System	0 – before 4.10.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 government-resource