PT-2023-23505 · Telefônica Brasil · Telefônica Brasil Vivo Play

Published 2023-06-05 · Updated 2023-06-13 · CVE-2023-31893

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Telefnica Brasil Vivo Play (IPTV) Firmware version 2023.04.04.01.06.15

Description The issue is related to a Denial of Service (DoS) via DNS Recursion. This means that the system can be made unavailable by exploiting its handling of DNS recursion, which is a process where a DNS server acts as a proxy for another DNS server to resolve a query.

Recommendations For Telefnica Brasil Vivo Play (IPTV) Firmware version 2023.04.04.01.06.15, as a temporary workaround, consider restricting DNS recursion to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2023-31893

Affected Products

Telefônica Brasil Vivo Play

References · 7

• 🔥 https://medium.com/@shooterRX/dns-recursion-leads-to-dos-attack-vivo-play-iptv-cve-2023-31893-b5ac45f38f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31893 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31893 · Vendor Advisory
• https://medium.com/%40shooterRX/dns-recursion-leads-to-dos-attack-vivo-play-iptv-cve-2023-31893-b5ac45f38f · Note
• https://t.me/cvenotify/51800 · Telegram Post
• https://t.me/cvenotify/52229 · Telegram Post
• https://cert.br/docs/whitepapers/dns-recursivo-aberto · Note