CVE-2023-0897

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.

Score

CVSS 3.1 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2023-10-26

Last modified

2025-01-16

Weaknesses

CWE-384

Affected products

• Polyeco1000 (Sielco)
• Polyeco1000 Firmware (Sielco)
• Polyeco300 Firmware (Sielco)
• Polyeco500 Firmware (Sielco)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07