PT-2023-12766 · Nokia · Asik Airscale

Joel Cretan · Published 2023-01-06 · Updated 2023-01-12 · CVE-2022-2482

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102

Description A vulnerability exists in Nokia’s ASIK AirScale system module that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary code execution in the bootloader.

Recommendations For versions 474021A.101 and 474021A.102, consider restricting access to the file system to prevent an attacker from placing a malicious script, until a patch is available. As a temporary workaround, consider disabling any functionality that allows scripts to be executed from the Linux-accessible file system.

Fix

Weakness Enumeration

CWE-1274

Related Identifiers

CVE-2022-2482

Affected Products

Asik Airscale

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-2482 · Security Note
• https://t.me/cibsecurity/56081 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-02 · Note