PT-2023-18796 · Audiocodes · Audiocodes Voip Desk Phones

Matthias Deeg + 1 · Publicado 2023-08-11 · Atualizado 2023-08-22 · CVE-2023-22955

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AudioCodes VoIP desk phones versions through 3.4.4.1000

Description An issue was discovered where the validation of firmware images only consists of simple checksum checks for different firmware components. This allows an attacker, by knowing how to calculate and where to store the required checksums for the flasher tool, to store malicious firmware.

Recommendations For versions through 3.4.4.1000, as a temporary workaround, consider restricting access to the flasher tool until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2023-22955

Produtos afetados

Audiocodes Voip Desk Phones

Referências · 12

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt · Exploit
• https://twitter.com/VulmonFeeds/status/1690132340385677312 · Publicação no Twitter
• https://t.me/cibsecurity/68384 · Publicação no Telegram
• http://seclists.org/fulldisclosure/2023/Aug/17 · Nota
• http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html · Nota
• https://twitter.com/CVEnew/status/1690085197310550017 · Publicação no Twitter
• https://twitter.com/TechFishNews/status/1690159847856320512 · Publicação no Twitter
• https://twitter.com/fletch_ai/status/1692357645133287636 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-22955 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1690555621987205121 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-22955 · Nota de Segurança
• https://syss.de · Nota