PT-2023-25670 · Kratos · Kratos Ngc Indoor Unit

Paul Noalhyt · Publicado 2023-07-18 · Atualizado 2023-07-28 · CVE-2023-36669

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kratos NGC Indoor Unit (IDU) versions prior to 11.4

Description The issue allows remote attackers to obtain arbitrary control of the IDU/ODU system due to missing authentication for a critical function. Attackers with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) by sending crafted TCP requests to the IDU.

Recommendations For versions prior to 11.4, update to version 11.4 or later to resolve the issue. As a temporary workaround, consider restricting layer-3 network access to the IDU to minimize the risk of exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2023-36669

Produtos afetados

Kratos Ngc Indoor Unit

Referências · 5

• https://t.me/cibsecurity/66941 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-36669 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36669 · Nota de Segurança
• https://kratosdefense.com/vulnerability-advisories/cve-2023-36669 · Aviso do Fabricante
• https://kratosdefense.com · Nota