PT-2023-18796 · Audiocodes · Audiocodes Voip Desk Phones

Matthias Deeg + 1 · Published 2023-08-11 · Updated 2023-08-22 · CVE-2023-22955

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AudioCodes VoIP desk phones versions through 3.4.4.1000

Description An issue was discovered where the validation of firmware images only consists of simple checksum checks for different firmware components. This allows an attacker, by knowing how to calculate and where to store the required checksums for the flasher tool, to store malicious firmware.

Recommendations For versions through 3.4.4.1000, as a temporary workaround, consider restricting access to the flasher tool until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-22955

Affected Products

Audiocodes Voip Desk Phones

References · 12

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt · Exploit
• https://osv.dev/vulnerability/CVE-2023-22955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22955 · Security Note
• https://twitter.com/VulmonFeeds/status/1690132340385677312 · Twitter Post
• https://t.me/cibsecurity/68384 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Aug/17 · Note
• http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html · Note
• https://twitter.com/CVEnew/status/1690085197310550017 · Twitter Post
• https://twitter.com/TechFishNews/status/1690159847856320512 · Twitter Post
• https://twitter.com/fletch_ai/status/1692357645133287636 · Twitter Post
• https://twitter.com/CVEnew/status/1690555621987205121 · Twitter Post
• https://syss.de · Note