PT-2023-25334 · Stw · Stw Tcg-4 Connectivity Module

Published 2023-06-29 · Updated 2024-11-27 · CVE-2023-35830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions STW TCG-4 Connectivity Module versions 3.03r0-Impala through 3.04r2-Jellyfish STW TCG-4lite Connectivity Module version 3.04r2-Jellyfish

Description The issue allows an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.

Recommendations For STW TCG-4 Connectivity Module versions 3.03r0-Impala through 3.04r2-Jellyfish, consider disabling remote access via SMS until a patch is available. For STW TCG-4lite Connectivity Module version 3.04r2-Jellyfish, consider disabling remote access via SMS until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-35830

Affected Products

Stw Tcg-4 Connectivity Module

References · 8

• https://stw-mobile-machines.com/fileadmin/user_upload/content/STW/PSIRT/STW-IR-23-001.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35830 · Vendor Advisory
• https://stw-mobile-machines.com/psirt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35830 · Security Note
• https://t.me/cvenotify/102638 · Telegram Post
• https://t.me/cvenotify/53334 · Telegram Post
• https://t.me/cibsecurity/65739 · Telegram Post
• https://t.me/cvenotify/53313 · Telegram Post