CVE-2023-3742
published 2023-12-20CVE-2023-3742: Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy restrictions via…
PriorityP424medium6.8CVSS 3.1
AVPACLPRNUINSUCHIHAH
EPSS
0.21%
11.8th percentile
Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy restrictions via physical access to the device. (Chromium security severity: High)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 114.0.5735.90 | 114.0.5735.90 | |
| chrome | >= 114.0.5735.90 < 114.0.5735.90 | 114.0.5735.90 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
nuclei·CVSS 8.7
CVE-2024-3742 [HIGH] Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.
Template:
id: CVE-2024-3742
info:
name: Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
author: Farish
severity: high
description: |
Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.
impact: |
Unauthenticated attackers can access cleartext credentials stored in controlloLogin.js, allowing system access.
remediation: |
Update Electrolink FM/DAB/TV Transmitter to a version that encrypts credentials properly.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-
2023-12-20
Published