Vulnerability-Lookup

BDU:2024-03900

Vulnerability from fstec - Published: 08.11.2023

Title

Уязвимость микропрограммного обеспечения модемов Telit Cinterion, связанная с раскрытием информации, позволяющая нарушителю получить информацию о скрытых виртуальных путях и именах файлов

Description

Уязвимость микропрограммного обеспечения модемов Telit Cinterion связана с раскрытием информации. Эксплуатация уязвимости может позволить нарушителю получить информацию о скрытых виртуальных путях и именах файлов

Severity


                    
                      AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vendor

Telit Cinterion, НПП «ИТЭЛМА»

Software Name

PDS6, PDS8, BGS5, EHS5, EHS6 Rel.2, EHS6 Rel.3, EHS6 Rel.4, EHS8, EHS8 Rel.4, ELS61-AUS REL.1, ELS61-AUS Rel.1 MR, ELS61-E REL.1, ELS61-E Rel.1 MR, ELS61-E Rel.2, ELS61-E2 REL.1, ELS61-E2 Rel.1 MR, ELS61-US Rel.1 MR, ELS61-US REL.2, ELS81-E Rel.1, ELS81-E Rel.1.1, ELS81-US Rel.1.1, PDS5-E Rel.1, PDS5-E Rel.4, PLS62-W, PLS62-W Rel.1, БЭГ ИТЭЛМА 1824.3879600, БЭГ ИТЭЛМА 8450020004, БЭГ ИТЭЛМА 8450031410, БЭГ ИТЭЛМА 8450008475, БЭГ ИТЭЛМА 8450033434, БЭГ ИТЭЛМА 8450103571, БЭГ ИТЭЛМА 8450103773, БЭГ ИТЭЛМА 8450042687, БЭГ ИТЭЛМА 111.3879000, БЭГ ИТЭЛМА 18.3879600-ХХ

Software Version

- (PDS6), - (PDS8), до RN 2.000 ARN 01.001.08 (BGS5), до RN 4.013 ARN 01.000.06 (EHS5), до RN 2.000 ARN 00.000.20 (EHS6 Rel.2), до RN 3.001 ARN 00.000.49 (EHS6 Rel.3), до RN 4.013 ARN 01.000.06 (EHS6 Rel.4), до RN 3.011 ARN 00.000.60 (EHS8), до RN 4.013 ARN 01.000.06 (EHS8 Rel.4), до RN 1.004 ARN 00.006.01 (ELS61-AUS REL.1), до RN 1.005 ARN 00.005.01 (ELS61-AUS Rel.1 MR), до RN 1.000 ARN 00.030.01 (ELS61-E REL.1), до RN 1.000 ARN 00.032.02 (ELS61-E Rel.1 MR), до RN 2.000 ARN 01.000.03 (ELS61-E Rel.2), до RN 1.000 ARN 00.026.01 (ELS61-E2 REL.1), до RN 1.000 ARN 00.032.02 (ELS61-E2 Rel.1 MR), до RN 1.01 ARN 00.028.01 (ELS61-US Rel.1 MR), до RN 2.012 ARN 01.000.05 (ELS61-US REL.2), до RN 4.000 ARN 01.000.05 (ELS81-E Rel.1), до RN 5.001 ARN 01.000.04 (ELS81-E Rel.1.1), до RN 5.012 ARN 01.000.05 (ELS81-US Rel.1.1), до RN 3.001 ARN 00.000.32 (PDS5-E Rel.1), до RN 4.013 ARN 01.000.06 (PDS5-E Rel.4), - (PLS62-W), - (PLS62-W Rel.1), - (БЭГ ИТЭЛМА 1824.3879600), - (БЭГ ИТЭЛМА 8450020004), - (БЭГ ИТЭЛМА 8450031410), - (БЭГ ИТЭЛМА 8450008475), - (БЭГ ИТЭЛМА 8450033434), - (БЭГ ИТЭЛМА 8450103571), - (БЭГ ИТЭЛМА 8450103773), - (БЭГ ИТЭЛМА 8450042687), - (БЭГ ИТЭЛМА 111.3879000), - (БЭГ ИТЭЛМА 18.3879600-ХХ)

Possible Mitigations

Использование следующих рекомендаций производителя: Для Telit Cinterion BGS5 обновление программного обеспечения до версии 2.000 ARN 01.001.08 и выше; Для Telit Cinterion EHS5-E обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion EHS5-US обновление программного обеспечения до версии 4.000 и выше; Для Telit Cinterion EHS5-US Rel.4 обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion EHS6 обновление программного обеспечения до версии 2.000 и выше; Для Telit Cinterion EHS6 Rel.2 обновление программного обеспечения до версии 2.000 ARN 00.000.20 и выше; Для Telit Cinterion EHS6 Rel.3 обновление программного обеспечения до версии 3.001 ARN 00.000.49 и выше; Для Telit Cinterion EHS6 Rel.4 обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion EHS6-A Rel.4 обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion EHS8 обновление программного обеспечения до версии 3.011 ARN 00.000.60 и выше; Для Telit Cinterion EHS8 Rel.4 обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion ELS61-AUS обновление программного обеспечения до версии 1.000 и выше; Для Telit Cinterion ELS61-AUS Rel.1 обновление программного обеспечения до версии 1.004 ARN 00.003.01 и выше; Для Telit Cinterion ELS61-AUS Rel.1 MR обновление программного обеспечения до версии 1.005 ARN 00.005.01 и выше; Для Telit Cinterion ELS61-E обновление программного обеспечения до версии 1.000 и выше; Для Telit Cinterion ELS61-E Rel.1 обновление программного обеспечения до версии 1.000 ARN 00.030.01 и выше; Для Telit Cinterion ELS61-E Rel.1 MR обновление программного обеспечения до версии 1.000 ARN 00.032.02 и выше; Для Telit Cinterion ELS61-E Rel.2 обновление программного обеспечения до версии 2.000 ARN 01.000.03 и выше; Для Telit Cinterion ELS61-E2 Rel.1 обновление программного обеспечения до версии 1.000 ARN 00.026.01 и выше; Для Telit Cinterion ELS61-E2 Rel.1 MR обновление программного обеспечения до версии 1.000 ARN 00.032.02 и выше; Для Telit Cinterion ELS61-US Rel.1 MR обновление программного обеспечения до версии 1.01 ARN 00.028.01 и выше; Для Telit Cinterion ELS61-US Rel.2 обновление программного обеспечения до версии 2.012 ARN 01.000.05 и выше; Для Telit Cinterion ELS81-E обновление программного обеспечения до версии 4.000 и выше; Для Telit Cinterion ELS81-E Rel.1 обновление программного обеспечения до версии 4.000 ARN 01.000.05 и выше; Для Telit Cinterion ELS81-E Rel.1.1 обновление программного обеспечения до версии 5.001 ARN 01.000.04 и выше; Для Telit Cinterion ELS81-US обновление программного обеспечения до версии 5.012 и выше; Для Telit Cinterion ELS81-US Rel.1.1 обновление программного обеспечения до версии 5.012 ARN 01.000.05 и выше; Для Telit Cinterion PDS5-E обновление программного обеспечения до версии 3.001 и выше; Для Telit Cinterion PDS5-E Rel.1 обновление программного обеспечения до версии 3.001 ARN 00.000.32 и выше; Для Telit Cinterion PDS5-E Rel.4 обновление программного обеспечения до версии 4.013 ARN 01.000.06 и выше; Для Telit Cinterion PLS62-W обновление программного обеспечения до версии 2.01 и выше; Для Telit Cinterion PLS62-W Rel.1 обновление программного обеспечения до версии 2.01 ARN 01.000.05 и выше; Для Telit Cinterion версий PDS5-US, PDS6, PDS8 использовать следующие компенсирующие меры: - применение проверки подписи приложения для запрета установки недоверенных MIDlet на устройстве; - использование физического разграничения доступа к устройствам; - сегментирование сети для ограничения возможности доступа к промышленному сегменту из других подсетей; - ограничение доступа к устройству из внешних сетей (Интернет); - ограничение возможности подключения недоверенных USB-устройств; - использование виртуальных частных сетей для организации удаленного доступа (VPN).

Reference

https://ics-cert.kaspersky.ru/advisories/2023/11/08/klcert-22-210-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor-vulnerability https://www.cve.org/CVERecord?id=CVE-2023-47614

CWE

CWE-200

JSON

To clipboard

Loading 2.2 MB of JSON…

CVE-2023-47614 (GCVE-0-2023-47614)

Vulnerability from cvelistv5 – Published: 2023-11-10 15:50 – Updated: 2024-09-03 17:37

Summary

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to disclose hidden virtual paths and file names on the targeted system.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 17:36 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

Kaspersky mitre root

References

1 reference

URL	Tags
https://ics-cert.kaspersky.com/advisories/2023/11…	third-party-advisory

Impacted products

35 products

Vendor	Product	Version
Telit Cinterion	BGS5	Affected: * , < 2.000 ARN 01.001.08 (custom)
Telit Cinterion	EHS5-E	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	EHS5-US	Affected: * , < 4.000 (custom)
Telit Cinterion	EHS5-US Rel.4	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	EHS6	Affected: * , < 2.000 (custom)
Telit Cinterion	EHS6 Rel.2	Affected: * , < 2.000 ARN 00.000.20 (custom)
Telit Cinterion	EHS6 Rel.3	Affected: * , < 3.001 ARN 00.000.49 (custom)
Telit Cinterion	EHS6 Rel.4	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	EHS6-A Rel.4	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	EHS8	Affected: * , < 3.011 ARN 00.000.60 (custom)
Telit Cinterion	EHS8 Rel.4	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	ELS61-AUS	Affected: * , < 1.000 (custom)
Telit Cinterion	ELS61-AUS Rel.1	Affected: * , < 1.004 ARN 00.003.01 (custom)
Telit Cinterion	ELS61-AUS Rel.1 MR	Affected: * , < 1.005 ARN 00.005.01 (custom)
Telit Cinterion	ELS61-E	Affected: * , < 1.000 (custom)
Telit Cinterion	ELS61-E Rel.1	Affected: * , < 1.000 ARN 00.030.01 (custom)
Telit Cinterion	ELS61-E Rel.1 MR	Affected: * , < 1.000 ARN 00.032.02 (custom)
Telit Cinterion	ELS61-E Rel.2	Affected: * , < 2.000 ARN 01.000.03 (custom)
Telit Cinterion	ELS61-E2 Rel.1	Affected: * , < 1.000 ARN 00.026.01 (custom)
Telit Cinterion	ELS61-E2 Rel.1 MR	Affected: * , < 1.000 ARN 00.032.02 (custom)
Telit Cinterion	ELS61-US Rel.1 MR	Affected: * , < 1.01 ARN 00.028.01 (custom)
Telit Cinterion	ELS61-US Rel.2	Affected: * , < 2.012 ARN 01.000.05 (custom)
Telit Cinterion	ELS81-E	Affected: * , < 4.000 (custom)
Telit Cinterion	ELS81-E Rel.1	Affected: * , < 4.000 ARN 01.000.05 (custom)
Telit Cinterion	ELS81-E Rel.1.1	Affected: * , < 5.001 ARN 01.000.04 (custom)
Telit Cinterion	ELS81-US	Affected: * , < 5.012 (custom)
Telit Cinterion	ELS81-US Rel.1.1	Affected: * , < 5.012 ARN 01.000.05 (custom)
Telit Cinterion	PDS5-E	Affected: * , < 3.001 (custom)
Telit Cinterion	PDS5-E Rel.1	Affected: * , < 3.001 ARN 00.000.32 (custom)
Telit Cinterion	PDS5-E Rel.4	Affected: * , < 4.013 ARN 01.000.06 (custom)
Telit Cinterion	PDS5-US
Telit Cinterion	PDS6
Telit Cinterion	PDS8
Telit Cinterion	PLS62-W	Affected: * , < 2.01 (custom)
Telit Cinterion	PLS62-W Rel.1	Affected: * , < 2.01 ARN 01.000.05 (custom)

Credits

Alexander Kozlov from Kaspersky Sergey Anufrienko from Kaspersky

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:09:37.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "KLCERT-22-210: Telit Cinterion (Thales/Gemalto) modules. Exposure of Sensitive Information to an Unauthorized Actor vulnerability",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-210-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor-vulnerability/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-47614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T17:36:50.567934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T17:37:01.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BGS5",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.000 ARN 01.001.08",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS5-E",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS5-US",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.000",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS5-US Rel.4",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS6",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.000",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS6 Rel.2",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.000 ARN 00.000.20",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS6 Rel.3",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "3.001 ARN 00.000.49",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS6 Rel.4",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS6-A Rel.4",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS8",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "3.011 ARN 00.000.60",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EHS8 Rel.4",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-AUS",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-AUS Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.004 ARN 00.003.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-AUS Rel.1 MR",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.005 ARN 00.005.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000 ARN 00.030.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E Rel.1 MR",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000 ARN 00.032.02",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E Rel.2",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.000 ARN 01.000.03",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E Rel.2",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.000 ARN 01.000.03",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E2 Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000 ARN 00.026.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-E2 Rel.1 MR",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.000 ARN 00.032.02",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-US Rel.1 MR",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "1.01 ARN 00.028.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS61-US Rel.2",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.012 ARN 01.000.05",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS81-E",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.000",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS81-E Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.000 ARN 01.000.05",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS81-E Rel.1.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "5.001 ARN 01.000.04",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS81-US",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "5.012",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ELS81-US Rel.1.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "5.012 ARN 01.000.05",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDS5-E",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "3.001",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDS5-E Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "3.001 ARN 00.000.32",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDS5-E Rel.4",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "4.013 ARN 01.000.06",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "PDS5-US",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PDS6",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PDS8",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "unaffected",
          "product": "PLS62-W",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.01",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PLS62-W Rel.1",
          "vendor": "Telit Cinterion",
          "versions": [
            {
              "lessThan": "2.01 ARN 01.000.05",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Kozlov from Kaspersky"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sergey Anufrienko from Kaspersky"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to disclose hidden virtual paths and file names on the targeted system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-10T15:50:24.884Z",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "name": "KLCERT-22-210: Telit Cinterion (Thales/Gemalto) modules. Exposure of Sensitive Information to an Unauthorized Actor vulnerability",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-210-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor-vulnerability/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Telit Cinterion has released firmware updates to fix the issue. Contact Telit Cinterion for assistance."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-02-21T12:45:00.000Z",
          "value": "Issue discovered by Kaspersky ICS CERT"
        },
        {
          "lang": "en",
          "time": "2023-04-27T15:56:00.000Z",
          "value": "Confirmed by Telit Cinterion"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Enforce application signature verification to prohibit the installation of untrusted MIDlets on the device."
        },
        {
          "lang": "en",
          "value": "Control physical access to the device at all stages of transportation to protect against the embedding of backdoors."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2023-47614",
    "datePublished": "2023-11-10T15:50:24.884Z",
    "dateReserved": "2023-11-07T10:06:48.689Z",
    "dateUpdated": "2024-09-03T17:37:01.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

BDU:2024-03900

CVE-2023-47614 (GCVE-0-2023-47614)

Tags

Sightings

Nomenclature