VPN Hub Vulnerability in Teltonika's Remote Management System
CVE-2023-32348

5.8MEDIUM

Key Information:

Vendor

Teltonika

Status
Remote Management System
Vendor
CVE Published:
22 May 2023

What is CVE-2023-32348?

Teltonika's Remote Management System, prior to version 4.10.0, features a VPN hub facilitating cross-device communication via OpenVPN. This setup permits new devices to connect and communicate freely with all other connected Teltonika devices. However, this mechanism introduces a potential security risk, as an attacker could exploit the OpenVPN server to route connections through it, allowing unauthorized scanning and data access from other Teltonika devices on the network.

Affected Version(s)

Remote Management System 0 < 4.10.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...
government-resource

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noam Moshe
Claroty Research
.