PT-2023-12767 · Nokia · Nokia Asik Airscale

Joel Cretan · Publicado 2023-01-06 · Atualizado 2023-01-13 · CVE-2022-2483

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102

Description The bootloader in the Nokia ASIK AirScale system module loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.

Recommendations For versions 474021A.101 and 474021A.102, update to a version that includes a fix for the secure boot issue to prevent permanent disablement. As a temporary workaround, consider restricting access to the flash contents to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-1282

Identificadores relacionados

CVE-2022-2483

Produtos afetados

Nokia Asik Airscale

Referências · 4

• https://t.me/cvenotify/41881 · Publicação no Telegram
• https://t.me/cibsecurity/56084 · Publicação no Telegram
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-2483 · Nota de Segurança