PT-2023-7028 · Atos · Atos Unify Openscape Session Border Controller+2

Armin Weihbold · Publicado 2023-07-06 · Atualizado 2023-10-07 · CVE-2023-36619

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Session Border Controller versions through V10 R3.01.03 Atos Unify OpenScape Branch (affected versions not specified) Atos Unify OpenScape BCF (affected versions not specified)

Description The issue allows execution of administrative scripts by unauthenticated users due to insufficient input validation in the implementation of the application programming interface of the Session Border Controller's firmware. This can be exploited remotely using HTTP requests, potentially allowing an attacker to perform arbitrary actions.

Recommendations For Atos Unify OpenScape Session Border Controller versions through V10 R3.01.03: Update to a version that addresses the insufficient input validation issue. For Atos Unify OpenScape Branch: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Atos Unify OpenScape BCF: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-08050

CVE-2023-36619

Produtos afetados

Atos Unify Openscape Bcf

Atos Unify Openscape Branch

Atos Unify Openscape Session Border Controller

Referências · 10

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape · Exploit
• 🔥 https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html · Exploit
• https://twitter.com/VulmonFeeds/status/1703830336675672401 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-36619 · Nota de Segurança
• https://t.me/cvenotify/59102 · Publicação no Telegram
• https://t.me/cibsecurity/71632 · Publicação no Telegram
• https://networks.unify.com/security/advisories/OBSO-2307-01.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-36619 · Aviso do Fabricante
• https://t.me/true_secator/4874 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-08050 · Nota de Segurança