CVE-2022-2483
Assigner: icscert
Published: 2023-01-06T21:04:52.603Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: ASIK AirScale 
vendor: Nokia
versions: status: affected
version: 474021A.101
status: affected
version: 474021A.102
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Joel Cretan
type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Red Balloon Security
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.</span>


value: 
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-1282
description: CWE-1282 Assumed-Immutable Data is Stored in Writable Memory
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>Nokia has released technical support notes containing mitigation instructions for impacted Nokia users. Users should <a target="_blank" rel="nofollow" href="https://customer.nokia.com/support/s/">contact Nokia</a>&nbsp;to receive further information.</p>
value: 
Nokia has released technical support notes containing mitigation instructions for impacted Nokia users. Users should  contact Nokia https://customer.nokia.com/support/s/  to receive further information.


source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev