PT-2023-27919 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Ta-Lun Yen · Published 2023-11-02 · Updated 2023-11-13 · CVE-2023-41351

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chunghwa Telecom NOKIA G-040W-Q (affected versions not specified)

Description The issue allows an unauthenticated remote attacker to bypass the authentication mechanism and log in to the device using an alternative URL. This enables attackers to log in as any existing user, including administrators, and perform arbitrary system operations or disrupt service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2023-41351

Affected Products

Chunghwa Telecom Nokia G-040W-Q

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-41351 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41351 · Vendor Advisory
• https://t.me/cvenotify/60468 · Telegram Post
• https://twitter.com/CVEnew/status/1720318038006985177 · Twitter Post
• https://twcert.org.tw/tw/cp-132-7501-6155a-1.html · Note