PT-2015-7504 · Csl · Csl Dualcom Gprs Cs2300-R

Andrew Tierney · Published 2015-11-25 · Updated 2015-11-27 · CVE-2015-7286

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53

Description The issue concerns the use of a polyalphabetic substitution cipher with hardcoded keys in the affected devices. This makes it easier for remote attackers to defeat the cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic.

Recommendations For CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53, consider updating the firmware to a version that does not rely on hardcoded keys for cryptographic protection, if such an update is available. As a temporary workaround, restrict access to the device's network traffic to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-7286

Affected Products

Csl Dualcom Gprs Cs2300-R

References · 4

• 🔥 http://cybergibbons.com/?p=2844 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7286 · Security Note
• http://kb.cert.org/vuls/id/BLUU-A3NQAL · Note
• http://kb.cert.org/vuls/id/428280 · Note