Lucene search

MitreCVE-2023-36669

HistoryJul 18, 2023 - 6:15 p.m.

CVE-2023-36669

2023-07-1818:15:12

CWE-306

mitre

web.nvd.nist.gov

cve-2023-36669

kratos ngc

indoor unit

authentication

remote attack

control

idu

odu

tpu

tcp requests

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.9%

JSON

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.

Affected configurations

Nvd

Node

kratosdefensengc_indoor_unitMatch-

AND

kratosdefensengc_indoor_unit_firmwareRange<11.4

VendorProductVersionCPE
kratosdefensengc_indoor_unit-cpe:2.3:h:kratosdefense:ngc_indoor_unit:-:*:*:*:*:*:*:*
kratosdefensengc_indoor_unit_firmware*cpe:2.3:o:kratosdefense:ngc_indoor_unit_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kratosdefense	ngc_indoor_unit	-	cpe:2.3:h:kratosdefense:ngc_indoor_unit:-:::::::*
kratosdefense	ngc_indoor_unit_firmware	*	cpe:2.3:o:kratosdefense:ngc_indoor_unit_firmware::::::::

References

kratosdefense.com

www.kratosdefense.com/vulnerability-advisories/cve-2023-36669

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.9%

JSON

Related for CVE-2023-36669