CVE-2023-23772
Assigner: NCSC-NL
Published: 2023-08-29T08:48:45.339Z
State: PUBLISHED
affected: vendor: Motorola
product: MBTS Site Controller
versions: version: R05.32.58
status: affected
defaultStatus: unknown
descriptions: value: Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a persistent implant on the device.
problemTypes: descriptions: cweId: CWE-347
description: Improper Verification of Cryptographic Signature
type: CWE
credits: value: Midnight Blue
type: finder
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:H/MUI:N/MS:U/MC:H/MI:H/MA:H