CVE-2023-35830: Stw-Mobile-Machines Tcg-4 Firmware

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.

Affected products

• Stw-Mobile-Machines Tcg-4 Firmware: version 3.01r1 only; version 3.02r0 only; version 3.03r0 only; version 3.04r2 only
• Stw-Mobile-Machines Tcg-4lite Firmware: version 3.04r2 only

Published 2023-06-29. Last modified 2026-06-17.