PT-2024-2712 · Adtran · Adtran Netvanta 3120

Edward Warren · Published 2024-03-26 · Updated 2024-10-28 · CVE-2024-28093

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AdTran NetVanta 3120 version 18.01.01.00.E

Description The issue is related to the TELNET service of AdTran NetVanta 3120 devices, which is enabled by default and has default credentials for a root-level account. This is associated with weaknesses in access control. Exploitation of the issue may allow a remote attacker to gain unauthorized access to the device.

Recommendations For AdTran NetVanta 3120 version 18.01.01.00.E, consider disabling the TELNET service or restricting access to it as a temporary workaround until a patch is available. Apply patches as soon as possible to fully resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1392

Related Identifiers

BDU:2024-02827

CVE-2024-28093

Affected Products

Adtran Netvanta 3120

References · 13

• 🔥 https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-28093 · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/AdTran/CWE-287 · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120.gif · Exploit
• https://bdu.fstec.ru/vul/2024-02827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28093 · Security Note
• https://vuldb.com/?id.257962 · Note
• https://twitter.com/CVEnew/status/1772592468833251821 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772634423315296752 · Twitter Post
• https://t.me/cvenotify/87623 · Telegram Post
• https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715 · Note
• https://t.me/cvenotify/93228 · Telegram Post
• https://t.me/cvenotify/74668 · Telegram Post
• https://twitter.com/oktsec/status/1773893354540986389 · Twitter Post