PT-2022-23302 · Airspeed+1 · Airspeed+1

Vladionescu · Published 2022-08-16 · Updated 2022-08-17 · CVE-2022-36307

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AirVelocity 1500 versions prior to 15.18.00.2511 Other AirVelocity and AirSpeed models (affected versions not specified)

Description The issue concerns the printing of SNMP credentials on the physically accessible serial port during boot. This could potentially expose sensitive information. The estimated number of affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For AirVelocity 1500 versions prior to 15.18.00.2511, update to software version 15.18.00.2511 or later. For other AirVelocity and AirSpeed models, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-36307

GHSA-8J75-QH6C-WPC5

Affected Products

Airspeed

Airvelocity 1500

References · 5

• https://osv.dev/vulnerability/CVE-2022-36307 · Vendor Advisory
• https://helpdesk.airspan.com/browse/TRN3-1693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36307 · Security Note
• https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-8j75-qh6c-wpc5 · Note
• https://t.me/cibsecurity/48200 · Telegram Post