Authentication flaw

2015-11-2504:59:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

44.9%

JSON

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response.

CPENameOperatorVersion
gprs_cs2300-r_firmwareeq1.25
gprs_cs2300-r_firmwareeq3.53

CPE	Name	Operator	Version
	gprs_cs2300-r_firmware	eq	1.25
	gprs_cs2300-r_firmware	eq	3.53

References

cybergibbons.com/?p=2844

www.kb.cert.org/vuls/id/428280

www.kb.cert.org/vuls/id/BLUU-A3NQAL