PT-2023-5420 · Atos · Atos Unify Openscape Branch+2

Armin Weihbold · Published 2023-09-18 · Updated 2023-10-07 · CVE-2023-36618

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Session Border Controller versions through V10 R3.01.03 Atos Unify OpenScape Branch (affected versions not specified) Atos Unify OpenScape BCF (affected versions not specified)

Description The issue allows execution of OS commands as root user by low-privileged authenticated users. It is related to deficiencies in the authentication procedure. Exploitation of the issue may allow a remote attacker to execute arbitrary code.

Recommendations For Atos Unify OpenScape Session Border Controller versions through V10 R3.01.03, consider restricting access to low-privileged users until a patch is available. For Atos Unify OpenScape Branch and Atos Unify OpenScape BCF, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Improper Authentication

Weakness Enumeration

CWE-78

CWE-287

Related Identifiers

BDU:2023-06050

CVE-2023-36618

Affected Products

Atos Unify Openscape Bcf

Atos Unify Openscape Branch

Atos Unify Openscape Session Border Controller

References · 10

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape · Exploit
• 🔥 https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html · Exploit
• https://networks.unify.com/security/advisories/OBSO-2307-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36618 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06050 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36618 · Security Note
• https://twitter.com/VulmonFeeds/status/1703830589999124594 · Twitter Post
• https://t.me/cibsecurity/71638 · Telegram Post
• https://t.me/true_secator/4874 · Telegram Post
• https://t.me/cvenotify/59103 · Telegram Post