Lucene search

TwcertCVELIST:CVE-2023-41351

HistoryNov 03, 2023 - 5:41 a.m.

CVE-2023-41351 Chunghwa Telecom NOKIA G-040W-Q - Broken Access Control

2023-11-0305:41:26

CWE-288

twcert

www.cve.org

chunghwa telecom

nokia

g-040w-q

broken access control

authentication bypass

unauthenticated attacker

alternative url

administrator privileges

arbitrary system operations

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing users, such as an administrator, to perform arbitrary system operations or disrupt service.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NOKIA G-040W-Q",
    "vendor": "Chunghwa Telecom",
    "versions": [
      {
        "status": "affected",
        "version": "G040WQR201207"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7501-6155a-1.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for CVELIST:CVE-2023-41351