PT-2023-12767 · Nokia · Nokia Asik Airscale

Joel Cretan · Published 2023-01-06 · Updated 2023-01-13 · CVE-2022-2483

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102

Description The bootloader in the Nokia ASIK AirScale system module loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.

Recommendations For versions 474021A.101 and 474021A.102, update to a version that includes a fix for the secure boot issue to prevent permanent disablement. As a temporary workaround, consider restricting access to the flash contents to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1282

Related Identifiers

CVE-2022-2483

Affected Products

Nokia Asik Airscale

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-2483 · Security Note
• https://t.me/cvenotify/41881 · Telegram Post
• https://t.me/cibsecurity/56084 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-02 · Note