CVE-2023-6929 Authorization Bypass Through User-Controlled Key in EuroTel ETL3100

High 7.5 Published 19 Dec 2023 Updated 6 May 2025

Attackers can bypass authorization to access hidden resources and execute privileged functionalities on EuroTel ETL3100 devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6929?

CVE-2023-6929 is a high-severity authentication bypass vulnerability in EuroTel ETL3100, published on 19 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the system, and execute privileged functionalities.

Weakness: CWE-639

Which versions are affected by CVE-2023-6929?

It affects 1 product.

Products include Eurotel Etl3100 Firmware.

How do I fix CVE-2023-6929?

No fix has been published for CVE-2023-6929 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-6929 being exploited?

There is no known exploitation of CVE-2023-6929 in the wild and no public exploit code.

Sources

Also known as GHSA-c3jv-hpf4-4rpw.