Unauthenticated configuration restore and firmware update
CVE-2023-43478

8.8HIGH

Key Information:

Vendor

Telstra

Status
Smart Modem Gen 2 (arcadyan Lh1000)
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43478?

The vulnerability allows unauthenticated attackers to upload arbitrary firmware images and configuration backups on the Telstra Smart Modem Gen 2. By exploiting this flaw, attackers can manipulate the device's firmware or configuration settings, potentially leading to complete code execution with root privileges. This poses a significant risk as it can enable unauthorized access and control over the affected device, jeopardizing network security.

Affected Version(s)

Smart Modem Gen 2 (Arcadyan LH1000) 0 < 0.18.15r

References

https://www.tenable.com/security/research/tra-2023-19

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.