PT-2018-2856 · Гранит · Гранит-Навигатор-6.18
Published
2018-12-20
·
Updated
2018-12-20
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Гранит-Навигатор-6.18
Description
The issue is related to the lack of a user authentication mechanism when configuring the device using SMS commands. This could allow a remote attacker to read and modify the device's configuration parameters, potentially compromising the system by using the SIM card's identification number.
Recommendations
For Гранит-Навигатор-6.18, consider implementing a secure authentication mechanism for configuration changes via SMS commands to prevent unauthorized access. As a temporary workaround, restrict the use of SMS commands for configuration changes until a proper authentication mechanism is in place.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Гранит-Навигатор-6.18