CVE-2023-23770 - Vulnerability Details - OpenCVE

Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00111.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Motorola

MBTS Site Controller

unknown

Version	Status	Constraints
`R05.32.58`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:motorola:mbts_site_controller_firmware:r05.32.58:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors	Products
Motorola Subscribe	Mbts Site Controller Subscribe Mbts Site Controller Firmware Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2023-27856	Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://tetraburst.com/

History

Wed, 02 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2023-08-29T08:47:13.848Z

Updated: 2024-10-02T14:38:55.765Z

Reserved: 2023-01-17T22:51:43.265Z

Link: CVE-2023-23770

Vulnrichment

Updated: 2024-08-02T10:42:26.206Z

NVD

Status : Modified

Published: 2023-08-29T09:15:07.993

Modified: 2024-11-21T07:46:47.720

Link: CVE-2023-23770

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23770", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "state": "PUBLISHED", "assignerShortName": "NCSC-NL", "dateReserved": "2023-01-17T22:51:43.265Z", "datePublished": "2023-08-29T08:47:13.848Z", "dateUpdated": "2024-10-02T14:38:55.765Z"}, "containers": {"cna": {"affected": [{"vendor": "Motorola", "product": "MBTS Site Controller", "versions": [{"version": "R05.32.58", "status": "affected"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-259", "description": "Use of Hard-coded Password", "type": "CWE"}]}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2023-08-29T08:47:13.848Z"}, "references": [{"name": "TETRA:BURST", "tags": ["related"], "url": "https://tetraburst.com/"}], "credits": [{"lang": "en", "value": "Midnight Blue", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:H/MA:H"}}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "v1", "taxonomyRelations": [{"taxonomyId": "T0891", "relationshipName": "mitigated by", "relationshipValue": "M0801"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:26.206Z"}, "title": "CVE Program Container", "references": [{"name": "TETRA:BURST", "tags": ["related", "x_transferred"], "url": "https://tetraburst.com/"}]}, {"affected": [{"vendor": "motorola", "product": "mbts_site_controller", "cpes": ["cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "r05.32.58", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T14:35:53.927079Z", "id": "CVE-2023-23770", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:38:55.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://tetraburst.com/", "name": "TETRA:BURST", "tags": ["related", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:26.206Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23770", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T14:35:53.927079Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*"], "vendor": "motorola", "product": "mbts_site_controller", "versions": [{"status": "affected", "version": "r05.32.58"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:38:51.710Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Midnight Blue"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:H/MA:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Motorola", "product": "MBTS Site Controller", "versions": [{"status": "affected", "version": "R05.32.58"}], "defaultStatus": "unknown"}], "references": [{"url": "https://tetraburst.com/", "name": "TETRA:BURST", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-259", "description": "Use of Hard-coded Password"}]}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2023-08-29T08:47:13.848Z"}, "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "v1", "taxonomyRelations": [{"taxonomyId": "T0891", "relationshipName": "mitigated by", "relationshipValue": "M0801"}]}]}}, "cveMetadata": {"cveId": "CVE-2023-23770", "state": "PUBLISHED", "dateUpdated": "2024-10-02T14:38:55.765Z", "dateReserved": "2023-01-17T22:51:43.265Z", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "datePublished": "2023-08-29T08:47:13.848Z", "assignerShortName": "NCSC-NL"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mbts_site_controller_firmware:r05.32.58:*:*:*:*:*:*:*", "matchCriteriaId": "87EB0F74-B3C6-4641-8678-1F8654BDFF8B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "044E6275-5F1D-496C-839F-909926D337B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled."}], "id": "CVE-2023-23770", "lastModified": "2024-11-21T07:46:47.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "cert@ncsc.nl", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-29T09:15:07.993", "references": [{"source": "cert@ncsc.nl", "tags": ["Not Applicable"], "url": "https://tetraburst.com/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://tetraburst.com/"}], "sourceIdentifier": "cert@ncsc.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-259"}], "source": "cert@ncsc.nl", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}