Read the docs
TI-2023-25166 Aliases CVE-2023-46664GHSA-fq72-4xq4-w8hg

Improper Access Control in Sielco PolyEco1000

Priority MEDIUM 46CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SielcoPolyEco1000CPU:2.0.6 FPGA:10.19; CPU:1.9.4 FPGA:10.19; CPU:1.9.3 FPGA:10.19; CPU:1.7.0 FPGA:10.16; CPU:2.0.2 FPGA:10.19; CPU:2.0.0 FPGA:10.19—No fix listedCNA
  • PolyEco1000 VendorSielco Affected CPU:2.0.6 FPGA:10.19; CPU:1.9.4 FPGA:10.19; CPU:1.9.3 FPGA:10.19; CPU:1.7.0 FPGA:10.16; CPU:2.0.2 FPGA:10.19; CPU:2.0.0 FPGA:10.19 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:sielco:polyeco500_firmware:1.7.0:*:*:*:cpu:*:*:*1.7.0VulnerableSielco
cpe:2.3:o:sielco:polyeco500_firmware:10.16:*:*:*:fpga:*:*:*10.16VulnerableSielco
cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:*not specified by NVDRunning onSielco
cpe:2.3:o:sielco:polyeco300_firmware:2.0.0:*:*:*:cpu:*:*:*2.0.0VulnerableSielco
cpe:2.3:o:sielco:polyeco300_firmware:2.0.2:*:*:*:cpu:*:*:*2.0.2VulnerableSielco
cpe:2.3:o:sielco:polyeco300_firmware:10.19:*:*:*:fpga:*:*:*10.19VulnerableSielco
cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:*not specified by NVDRunning onSielco
cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3:*:*:*:cpu:*:*:*1.9.3VulnerableSielco
cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4:*:*:*:cpu:*:*:*1.9.4VulnerableSielco
cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6:*:*:*:cpu:*:*:*2.0.6VulnerableSielco
  • cpe:2.3:o:sielco:polyeco500_firmware:1.7.0:*:*:*:cpu:*:*:* Versions 1.7.0 Vulnerable ·Sielco
  • cpe:2.3:o:sielco:polyeco500_firmware:10.16:*:*:*:fpga:*:*:* Versions 10.16 Vulnerable ·Sielco
  • cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sielco
  • cpe:2.3:o:sielco:polyeco300_firmware:2.0.0:*:*:*:cpu:*:*:* Versions 2.0.0 Vulnerable ·Sielco
  • cpe:2.3:o:sielco:polyeco300_firmware:2.0.2:*:*:*:cpu:*:*:* Versions 2.0.2 Vulnerable ·Sielco
  • cpe:2.3:o:sielco:polyeco300_firmware:10.19:*:*:*:fpga:*:*:* Versions 10.19 Vulnerable ·Sielco
  • cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sielco
  • cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3:*:*:*:cpu:*:*:* Versions 1.9.3 Vulnerable ·Sielco
  • cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4:*:*:*:cpu:*:*:* Versions 1.9.4 Vulnerable ·Sielco
  • cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6:*:*:*:cpu:*:*:* Versions 2.0.6 Vulnerable ·Sielco
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:sielco:polyeco1000_firmware:10.19:*:*:*:fpga:*:*:*10.19VulnerableSielco
cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:*not specified by NVDRunning onSielco
  • cpe:2.3:o:sielco:polyeco1000_firmware:10.19:*:*:*:fpga:*:*:* Versions 10.19 Vulnerable ·Sielco
  • cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sielco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46664
  2. 2026-10-03 Alias added: GHSA-fq72-4xq4-w8hg

References

Advisory 1

  • TI-2023-25167 Improper Access Control in Sielco PolyEco1000 CVSS 3.1CRITICAL 9.8
  • TI-2023-25163 Improper Access Control in Sielco PolyEco1000 CVSS 3.1CRITICAL 9.8
  • TI-2023-05293 Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000 CVSS 3.1CRITICAL 9.8
  • TI-2023-00849 Session FIxation in Sielco PolyEco1000 CVSS 3.1CRITICAL 9.8
  • TI-2023-25165 Improper Access Control in Sielco PolyEco1000 CVSS 3.1HIGH 8.1
  • TI-2023-25164 Improper Access Control in Sielco PolyEco1000 CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences