PT-2023-22514 · Magicjack · Magicjack A921 Usb Phone Jack

Published 2023-04-28 · Updated 2025-01-31 · CVE-2023-30024

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MagicJack A921 USB Phone Jack versions prior to Rev 3.0 V1.4

Description The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer.

Recommendations For versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4, update the firmware to Rev 3.0 V1.4 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2023-30024

Affected Products

Magicjack A921 Usb Phone Jack

References · 10

• 🔥 https://samuraisecurity.co.uk/red-teaming-0x01-click-rce-via-voip-usb · Exploit
• 🔥 https://drive.google.com/drive/folders/1cKd8hksThK610GPtBQ3du8DEkwKywlAi?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2023-30024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30024 · Security Note
• https://t.me/cibsecurity/63047 · Telegram Post
• https://t.me/cvenotify/49296 · Telegram Post
• https://pastebin.com/raw/irWcawp8 · Note
• https://magicjack.com · Note
• https://t.me/cvenotify/50290 · Telegram Post
• https://t.me/cvenotify/109474 · Telegram Post