Vulnerability · Published Oct 31, 2023 · Assigned by GitHub_M

CVE-2023-46723lte-pic32-writer's sendto.txt may disclose URL and the API key

High 8.9

In plain English

A high-severity security flaw in lte-pic32-writer from paijp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.9High

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.

Affected products (as reported)

Vendor	Product	Versions
paijp	lte-pic32-writer	<= 0.0.1

Weakness: CWE-538 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh x_refsource_CONFIRM