PT-2023-22881 · Telecom · Telecom

Balance · CVE-2023-30683 · Published 2023-08-10 · Updated 2023-08-14

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Telecom versions prior to SMR Aug-2023 Release 1

Description The issue is related to improper access control, allowing local attackers to call the "endCall API" without permission. This can be exploited by attackers to potentially disrupt or manipulate call functionality.

Recommendations For versions prior to SMR Aug-2023 Release 1, consider restricting access to the "endCall API" until a patch is available. As a temporary workaround, disabling the API or limiting its functionality can help minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-30683

Affected Products

Telecom

References · 5

• https://osv.dev/vulnerability/CVE-2023-30683 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30683 · Security Note
• https://t.me/cibsecurity/68157 · Telegram Post
• https://t.me/cvenotify/56422 · Telegram Post