PT-2022-26446 · Unknown · Openharmony

Published 2022-10-14 · Updated 2022-10-17 · CVE-2022-42463

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHarmony versions prior to 3.1.2

Description The issue is related to an authentication bypass vulnerability in the callback handler function of Softbus server in the communication subsystem. Attackers can exploit this by sending Bluetooth rfcomm packets to any remote device, allowing them to execute arbitrary commands on distributed networks.

Recommendations For OpenHarmony versions prior to 3.1.2, as a temporary workaround, consider disabling the callback handler function of Softbus server in the communication subsystem until a patch is available. Restrict access to the Softbus server to minimize the risk of exploitation. Avoid using the vulnerable function to handle Bluetooth rfcomm packets until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-42463

Affected Products

Openharmony

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-42463 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42463 · Vendor Advisory
• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md · Note
• https://t.me/cibsecurity/51429 · Telegram Post