PT-2023-25670 · Kratos · Kratos Ngc Indoor Unit

Paul Noalhyt · Published 2023-07-18 · Updated 2023-07-28 · CVE-2023-36669

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kratos NGC Indoor Unit (IDU) versions prior to 11.4

Description The issue allows remote attackers to obtain arbitrary control of the IDU/ODU system due to missing authentication for a critical function. Attackers with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) by sending crafted TCP requests to the IDU.

Recommendations For versions prior to 11.4, update to version 11.4 or later to resolve the issue. As a temporary workaround, consider restricting layer-3 network access to the IDU to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-36669

Affected Products

Kratos Ngc Indoor Unit

References · 5

• https://osv.dev/vulnerability/CVE-2023-36669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36669 · Security Note
• https://kratosdefense.com/vulnerability-advisories/cve-2023-36669 · Vendor Advisory
• https://t.me/cibsecurity/66941 · Telegram Post
• https://kratosdefense.com · Note