What’s Vulnerable › Vulnerabilities

CVE-2023-46723: lte-pic32-writer's sendto.txt may disclose URL and the API key

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-31 · updated 2026-06-17
• Weakness: CWE-538

Description

lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.

Affected products

• paijp lte-pic32-writer: before 0.0.3 — fixed in 0.0.3

How to fix

Upgrade to a fixed version: paijp lte-pic32-writer 0.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh
• https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh

Get alerted when CVE-2023-46723 or the next vulnerability affects your stack