CVE-2023-35830
Critical
Description
STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.
SeverityCritical
CVSS9.8
Exploit probability—
ProductStw-mobile-machines Tcg-4 Firmware
PublishedJun 29, 2023
First seenJun 29, 2023
Weakness typeCWE-306Missing authentication for critical function
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stw-mobile-machines tcg-4_firmware | 3.01r1, 3.02r0, 3.03r0, 3.04r2 | — |
| stw-mobile-machines tcg-4lite_firmware | 3.04r2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.