PT-2014-2636 · Sierra Wireless · Airlink Raven X Ev-Do Gateway

Publicado 2014-01-15 · Atualizado 2014-01-16 · CVE-2013-2820

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink Raven X EV-DO gateway versions 4221 4.0.11.003 and 4228 4.0.11.003

Description The issue allows remote attackers to reprogram the firmware via a replay attack using UDP ports 17336 and 17388.

Recommendations For versions 4221 4.0.11.003 and 4228 4.0.11.003, consider restricting access to UDP ports 17336 and 17388 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-2820

Produtos afetados

Airlink Raven X Ev-Do Gateway

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2820 · Nota de Segurança
• http://sierrawireless.com/resources/support/airlink/docs/raven%20security%20vulnerability%202014-01-10.pdf · Aviso do Fabricante
• http://ics-cert.us-cert.gov/advisories/ICSA-14-007-01A · Nota