Lucene search

IcscertCVE-2022-2482

HistoryJan 06, 2023 - 10:15 p.m.

CVE-2022-2482

2023-01-0622:15:09

CWE-1274

icscert

web.nvd.nist.gov

cve-2022-2482

nokia

asik airscale

vulnerability

arbitrary code execution

bootloader

nvd

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

Percentile

10.8%

JSON

A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary code execution in the bootloader.

Affected configurations

Nvd

Node

nokiaasik_airscale_474021a.102_firmwareMatch-

AND

nokiaasik_airscale_474021a.102Match-

Node

nokiaasik_airscale_474021a.101_firmwareMatch-

AND

nokiaasik_airscale_474021a.101Match-

VendorProductVersionCPE
nokiaasik_airscale_474021a.102_firmware-cpe:2.3:o:nokia:asik_airscale_474021a.102_firmware:-:*:*:*:*:*:*:*
nokiaasik_airscale_474021a.102-cpe:2.3:h:nokia:asik_airscale_474021a.102:-:*:*:*:*:*:*:*
nokiaasik_airscale_474021a.101_firmware-cpe:2.3:o:nokia:asik_airscale_474021a.101_firmware:-:*:*:*:*:*:*:*
nokiaasik_airscale_474021a.101-cpe:2.3:h:nokia:asik_airscale_474021a.101:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nokia	asik_airscale_474021a.102_firmware	-	cpe:2.3:o:nokia:asik_airscale_474021a.102_firmware:-:::::::*
nokia	asik_airscale_474021a.102	-	cpe:2.3:h:nokia:asik_airscale_474021a.102:-:::::::*
nokia	asik_airscale_474021a.101_firmware	-	cpe:2.3:o:nokia:asik_airscale_474021a.101_firmware:-:::::::*
nokia	asik_airscale_474021a.101	-	cpe:2.3:h:nokia:asik_airscale_474021a.101:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ASIK AirScale ",
    "vendor": "Nokia",
    "versions": [
      {
        "status": "affected",
        "version": "474021A.101"
      },
      {
        "status": "affected",
        "version": "474021A.102"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-307-02

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

Percentile

10.8%

JSON

Related for CVE-2022-2482