CVE-2023-46389

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Nov/7Mailing List, Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Nov/7Mailing List, Third Party Advisory
https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/

Timeline

Published: Nov 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-46397.4A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue cou CVE-2023-463937.5gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' pass CVE-2023-463945.4A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web s CVE-2023-463965.4Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters.CVE-2023-46407.5The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This CVE-2023-464009.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.CVE-2023-464019.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.CVE-2023-464027.5git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.CVE-2023-464049.9PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.CVE-2023-464075.5FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() f CVE-2023-464089.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.CVE-2023-464099.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.