PT-2022-17157 · Openssl · Openssl

Olivia Lucca Fraser · Published 2022-03-07 · Updated 2023-08-08 · CVE-2022-25218

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to K2 22.5.9.163 OpenSSL versions prior to K3C 32.1.15.93

Description The issue allows an unauthenticated attacker on the local area network to gain control over the plaintext to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA public decrypt() function. This is due to the use of the RSA algorithm without OAEP or any other padding scheme in telnetd startup. The attacker can manipulate the telnetd startup state machine and obtain a root shell on the device by exchanging crafted UDP packets.

Recommendations For versions prior to K2 22.5.9.163, update to version K2 22.5.9.163 or later to resolve the issue. For versions prior to K3C 32.1.15.93, update to version K3C 32.1.15.93 or later to resolve the issue. As a temporary workaround, consider restricting access to the telnetd startup function until a patch is available.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2022-25218

Affected Products

Openssl

References · 4

• 🔥 https://tenable.com/security/research/tra-2022-01 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25218 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25218 · Vendor Advisory
• https://t.me/cibsecurity/38667 · Telegram Post