PT-2014-2635 · Sierra Wireless · Airlink Raven X Ev-Do Gateway

Publicado 2014-01-15 · Atualizado 2014-01-16 · CVE-2013-2819

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink Raven X EV-DO gateway versions 4221 4.0.11.003 through 4221 4.0.11.003 Sierra Wireless AirLink Raven X EV-DO gateway versions 4228 4.0.11.003 through 4228 4.0.11.003

Description The issue allows remote attackers to install Trojan horse firmware by leveraging cleartext credentials in a crafted update or reprogramming action.

Recommendations For Sierra Wireless AirLink Raven X EV-DO gateway version 4221 4.0.11.003, update to a version that does not use cleartext credentials for updates or reprogramming actions. For Sierra Wireless AirLink Raven X EV-DO gateway version 4228 4.0.11.003, update to a version that does not use cleartext credentials for updates or reprogramming actions.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-2819

Produtos afetados

Airlink Raven X Ev-Do Gateway

Referências · 3

• http://sierrawireless.com/resources/support/airlink/docs/raven%20security%20vulnerability%202014-01-10.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2819 · Nota de Segurança
• http://ics-cert.us-cert.gov/advisories/ICSA-14-007-01A · Nota