by Kastro
Paper/Archive/CVE-2023-24022

CVE-2023-24022

Baicells Nova 227 — Hard Coded Credential Crypt Vulnerability

EPSS 2%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 75.2.752 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Affected

ProductAffectedFixed inSource
Nova 227≤ 3.7.11.3–CNA
Nova 233≤ 3.7.11.3–CNA
Nova 243≤ 3.7.11.3–CNA

Scores by source

Baicells (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorybaicells.zendesk.com/hc/en-us/articles/6188324645780-2023-1-17-Hard-Coded-Credential-Crypt-Vulnerabilitypatchimg.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMGrefimg.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf