CVE-2023-43478 Vulnerability Details

  /     /     /  

CVE-2023-43478 Metadata Quick Info

CVE Published: 20/09/2023 | CVE Updated: 24/09/2024 | CVE Year: 2023
Source: tenable | Vendor: Telstra | Product: Smart Modem Gen 2 (Arcadyan LH1000)
Status : PUBLISHED

---

CVE-2023-43478 Description

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root. 

Metrics

CVSS Version: 3.1 | Base Score: 8.8 HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* ADJACENT_NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID:
CWE Name:
Source: Telstra

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-176
CAPEC Description: CAPEC-176 Configuration/Environment Manipulation


Source: NVD (National Vulnerability Database).