PT-2023-15491 · Vtech · Bezeq Vtech Nb403-Il+1

00Xbyte · Publicado 2023-09-15 · Atualizado 2023-09-20 · CVE-2022-47848

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bezeq Vtech NB403-IL version BZ 2.02.07.09.13.01 Vtech IAD604-IL versions BZ 2.02.07.09.13.01, BZ 2.02.07.09.13T, and BZ 2.02.07.09.09T

Description An issue was discovered that allows remote attackers to gain sensitive information via the rootDesc.xml page of the UPnP service.

Recommendations For Bezeq Vtech NB403-IL version BZ 2.02.07.09.13.01, consider restricting access to the UPnP service until a patch is available. For Vtech IAD604-IL versions BZ 2.02.07.09.13.01, BZ 2.02.07.09.13T, and BZ 2.02.07.09.09T, restrict access to the UPnP service to minimize the risk of exploitation. As a temporary workaround, consider disabling the rootDesc.xml page access until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2022-47848

Produtos afetados

Bezeq Vtech Nb403-Il

Vtech Iad604-Il

Referências · 5

• 🔥 https://00xbyte.github.io/posts/bezeq-router-auth-bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47848 · Nota de Segurança
• https://t.me/cibsecurity/70600 · Publicação no Telegram
• https://twitter.com/DMFezzaReedCISA/status/1704364027000897626 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2022-47848 · Aviso do Fabricante