CVE-2023-31634
Last modified
CVE-2023-31634 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. EPSS estimates a 0.86% chance of exploitation in the next 30 days.
Description
In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. At that time, the default username and password can be used to enter the Grafana management console without logging in, a related issue to CVE-2022-23126.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Teslamate | Teslamate | < 1.27.2 |
References
- https://github.com/XC9409/CVE-2023-31634/blob/main/PoCThird Party Advisory
- https://github.com/XC9409/CVE-2023-31634/blob/main/PoCThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-31634?
How severe is CVE-2023-31634?
How do I fix CVE-2023-31634?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-31627An issue in the strhash component of openlink virtuoso-opens…7.5
- CVE-2023-31628An issue in the stricmp component of openlink virtuoso-opens…7.5
- CVE-2023-31629An issue in the sqlo_union_scope component of openlink virtu…7.5
- CVE-2023-3163A vulnerability was found in y_project RuoYi up to 4.7.7. It…7.5
- CVE-2023-31630An issue in the sqlo_query_spec component of openlink virtuo…7.5
- CVE-2023-31631An issue in the sqlo_preds_contradiction component of openli…7.5
- CVE-2023-3164A heap-buffer-overflow vulnerability was found in LibTIFF, i…5.5
- CVE-2023-3165A vulnerability was found in SourceCodester Life Insurance M…6.1
- CVE-2023-31654Redis raft master-1b8bd86 to master-7b46079 was discovered t…9.8
- CVE-2023-31655redis v7.0.10 was discovered to contain a segmentation viola…7.5
- CVE-2023-3166The Lana Email Logger plugin for WordPress is vulnerable to …6.1
- CVE-2023-31664A reflected cross-site scripting (XSS) vulnerability in /aut…6.1
Are you affected by CVE-2023-31634?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST