PT-2024-12267 · Unknown · Airvantage

Published 2024-12-20 · Updated 2024-12-21 · CVE-2023-31280

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AirVantage (affected versions not specified)

Description The AirVantage online Warranty Checker tool has a vulnerability that could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The issue arises when using the Serial Number or IMEI to look up warranty status, as the tool previously returned the IMEI and Serial Number in addition to the warranty status.

Recommendations To resolve the issue, the AirVantage Warranty Checker has been updated to no longer return the IMEI and Serial Number when looking up warranty status. At the moment, there is no information about a specific version that contains a fix for this vulnerability.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-31280

Affected Products

Airvantage

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-31280 · Security Note
• https://t.me/cvedetector/13475 · Telegram Post
• https://t.me/cvenotify/105219 · Telegram Post
• https://twitter.com/CVEnew/status/1870255489008758910 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1870270045500150056 · Twitter Post
• https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002 · Note