PT-2022-13792 · Hills · Hills Comnav

Published 2022-04-20 · Updated 2023-07-24 · CVE-2022-1318

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hills ComNav version 3002-19

Description The issue concerns a weak communication channel in the configuration pages of the system. Traffic across the local network can be viewed by a malicious actor, and the size of certain communications packets is predictable. This predictability allows an attacker to learn the state of the system even if the traffic is encrypted, such as with WPA2, since the packet sizes remain observable. The communication encryption scheme, although theoretically sound, does not provide the level of protection required.

Recommendations For Hills ComNav version 3002-19, consider implementing a more robust encryption scheme to protect the communication channel, and restrict access to the configuration pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Inadequate Encryption Strength

Weakness Enumeration

CWE-203

CWE-326

Related Identifiers

CVE-2022-1318

Affected Products

Hills Comnav

References · 5

• https://osv.dev/vulnerability/CVE-2022-1318 · Vendor Advisory
• https://corporate.carrier.com/Images/CARR-PSA-Hills-ComNav-002-1121_tcm558-149392.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1318 · Security Note
• https://t.me/cvenotify/29496 · Telegram Post
• https://t.me/cibsecurity/41185 · Telegram Post