PT-2018-2859 · Гранит · Гранит-Навигатор-6.18
Published
2018-12-20
·
Updated
2018-12-20
CVSS v2.0
4.7
Medium
| Vector | AV:L/AC:H/Au:N/C:P/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Гранит-Навигатор-6.18
Description
The issue is related to the use of uncontrolled format strings in the device's embedded software. An attacker can exploit this by sending a specially crafted SMS command, such as BB+GP=vuln%x, when connected to the device using the USB interface, potentially leading to a denial of service.
Recommendations
For Гранит-Навигатор-6.18, consider restricting access to the device's USB interface to minimize the risk of exploitation until a patch is available. Avoid using the device's SMS command functionality with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of Externally-Controlled Format String
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Гранит-Навигатор-6.18