CVE-2023-36669

2023-07-1800:00:00

mitre

www.cve.org

cve-2023-36669

authentication missing

kratos ngc indoor unit

remote control

layer-3 network access

touch panel unit (tpu)

crafted tcp requests

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

69.9%

JSON

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.

References

kratosdefense.com

www.kratosdefense.com/vulnerability-advisories/cve-2023-36669