A vulnerability, which was classified as problematic, has been found in Relyum RELY-PCIe and RELY-REC 22.2.1/23.1.0. This issue affects some unknown functionality. The manipulation with an unknown input leads to a unverified password change vulnerability. Using CWE to declare the problem leads to CWE-620. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Impacted is integrity. The summary by CVE is:

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password.

The weakness was published 12/13/2023. It is possible to read the advisory at relyum.com. The identification of this vulnerability is CVE-2023-47577 since 11/06/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Relyum

Name

• RELY-PCIe
• RELY-REC

Version

• 22.2.1
• 23.1.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion