SB2023031315 - Multiple vulnerabilities in Akuvox E11
Published: March 13, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2023-0348)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information on the system.
The vulnerability exists due to improper access restrictions within SIP calls. A remote attacker can activate the camera and microphone and contact any device within Akuvox to call any other device.
2) Command Injection (CVE-ID: CVE-2023-0351)
CWE-ID: CWE-77 - Command injection
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the device phone-book contacts functionality in the "call log" page. A remote attacker on the local network can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Missing Authentication for Critical Function (CVE-ID: CVE-2023-0354)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to missing authentication for a critical function. A remote attacker on the local network can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Storing passwords in a recoverable format (CVE-ID: CVE-2023-0353)
CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the affected product uses a weak encryption algorithm for stored passwords and a hard-coded password for decryption. A remote attacker can cause the encrypted passwords to be decrypted from the configuration file.
5) Missing Authorization (CVE-ID: CVE-2023-0349)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to a missing permission check in libvoice library. A remote attacker on the local network can view and record image and video from the camera.
6) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2023-0355)
CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a hard-coded cryptographic key. A remote attacker on the local network can decrypt sensitive information.
7) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2023-0352)
CWE-ID: CWE-640 - Weak password recovery mechanism
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a weak password recovery mechanism for forgotten password. A remote attacker can download the device key file and reset the password back to the default.
8) Reliance on File Name or Extension of Externally-Supplied File (CVE-ID: CVE-2023-0350)
CWE-ID: CWE-646 - Reliance on File Name or Extension of Externally-Supplied File
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to the affected product does not ensure that a file extension is associated with the file provided. A remote attacker can change the extension of a malicious file to an accepted file type and upload a file to the device.
9) Information disclosure (CVE-ID: CVE-2023-0347)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can identify the device on the Akuvox cloud.
10) Improper Authentication (CVE-ID: CVE-2023-0346)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when cloud login is performed through an unencrypted HTTP connection. A remote attacker can gain access to the Akuvox cloud and device if the MAC address of a device is known.
11) Use of hard-coded credentials (CVE-ID: CVE-2023-0345)
CWE-ID: CWE-798 - Use of Hard-coded Credentials
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in application code within the secure shell (SSH) server. A remote attacker can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Hidden functionality (CVE-ID: CVE-2023-0344)
CWE-ID: CWE-912 - Hidden Functionality (Backdoor)
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to compromise vulnerable system
The vulnerability exists due to the affected software uses a custom version of dropbear SSH server. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.
13) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2023-0343)
CWE-ID: CWE-329 - Not Using an Unpredictable IV with CBC Mode
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product contains a function that encrypts messages which are then forwarded. A remote attacker on the local network can decrypt messages.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.