Lucene search

NCSC.chCVE-2023-0011

HistoryDec 20, 2023 - 8:15 a.m.

CVE-2023-0011

2023-12-2008:15:43

CWE-78

CWE-20

NCSC.ch

web.nvd.nist.gov

cve-2023-0011

toby-l2

input validation

arbitrary execution

at commands

physical access

root privileges

nvd

vulnerability

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

21.0%

JSON

A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands.

Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well…

This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.

Affected configurations

Nvd

Node

u-bloxtoby-l200_firmwareMatch-

AND

u-bloxtoby-l200Match-

Node

u-bloxtoby-l201_firmwareMatch-

AND

u-bloxtoby-l201Match-

Node

u-bloxtoby-l210_firmwareMatch-

AND

u-bloxtoby-l210Match-

Node

u-bloxtoby-l220_firmwareMatch-

AND

u-bloxtoby-l220Match-

Node

u-bloxtoby-l280_firmwareMatch-

AND

u-bloxtoby-l280Match-

VendorProductVersionCPE
u-bloxtoby-l200_firmware-cpe:2.3:o:u-blox:toby-l200_firmware:-:*:*:*:*:*:*:*
u-bloxtoby-l200-cpe:2.3:h:u-blox:toby-l200:-:*:*:*:*:*:*:*
u-bloxtoby-l201_firmware-cpe:2.3:o:u-blox:toby-l201_firmware:-:*:*:*:*:*:*:*
u-bloxtoby-l201-cpe:2.3:h:u-blox:toby-l201:-:*:*:*:*:*:*:*
u-bloxtoby-l210_firmware-cpe:2.3:o:u-blox:toby-l210_firmware:-:*:*:*:*:*:*:*
u-bloxtoby-l210-cpe:2.3:h:u-blox:toby-l210:-:*:*:*:*:*:*:*
u-bloxtoby-l220_firmware-cpe:2.3:o:u-blox:toby-l220_firmware:-:*:*:*:*:*:*:*
u-bloxtoby-l220-cpe:2.3:h:u-blox:toby-l220:-:*:*:*:*:*:*:*
u-bloxtoby-l280_firmware-cpe:2.3:o:u-blox:toby-l280_firmware:-:*:*:*:*:*:*:*
u-bloxtoby-l280-cpe:2.3:h:u-blox:toby-l280:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
u-blox	toby-l200_firmware	-	cpe:2.3:o:u-blox:toby-l200_firmware:-:::::::*
u-blox	toby-l200	-	cpe:2.3:h:u-blox:toby-l200:-:::::::*
u-blox	toby-l201_firmware	-	cpe:2.3:o:u-blox:toby-l201_firmware:-:::::::*
u-blox	toby-l201	-	cpe:2.3:h:u-blox:toby-l201:-:::::::*
u-blox	toby-l210_firmware	-	cpe:2.3:o:u-blox:toby-l210_firmware:-:::::::*
u-blox	toby-l210	-	cpe:2.3:h:u-blox:toby-l210:-:::::::*
u-blox	toby-l220_firmware	-	cpe:2.3:o:u-blox:toby-l220_firmware:-:::::::*
u-blox	toby-l220	-	cpe:2.3:h:u-blox:toby-l220:-:::::::*
u-blox	toby-l280_firmware	-	cpe:2.3:o:u-blox:toby-l280_firmware:-:::::::*
u-blox	toby-l280	-	cpe:2.3:h:u-blox:toby-l280:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "TOBY-L2",
    "vendor": "u-blox",
    "versions": [
      {
        "status": "affected",
        "version": "TOBY-L200"
      },
      {
        "status": "affected",
        "version": "TOBY-L201"
      },
      {
        "status": "affected",
        "version": "TOBY-L210"
      },
      {
        "status": "affected",
        "version": "TOBY-L220"
      },
      {
        "status": "affected",
        "version": "TOBY-L280"
      }
    ]
  }
]

References

www.u-blox.com/en/report-security-issues

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

21.0%

JSON

Related for CVE-2023-0011