Search
Find a vulnerability
Search criteria
2 vulnerabilities found for wavelite_metro_200_and_f2b_fans_firmware by nokia
CVE-2023-22618 (GCVE-0-2023-22618)
Vulnerability from nvd – Published: 2023-10-04 00:00 – Updated: 2024-09-20 13:55
VLAI
EPSS
VEX
Summary
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-284 - Improper Access Control
Assigner
References
2 references
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| nokia | wavelite_metro_200_and_fan |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_and_fan:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ops_and_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ops_and_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_and_f2b_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ne_ops_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ne_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ne_and_f2b_fans:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:13:49.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://nokia.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_and_fan:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_and_fan",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ops_and_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ops_and_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_ops_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_ops_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T13:46:32.187988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T13:55:55.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-04T11:49:54.260Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://nokia.com"
},
{
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-22618",
"datePublished": "2023-10-04T00:00:00.000Z",
"dateReserved": "2023-01-04T00:00:00.000Z",
"dateUpdated": "2024-09-20T13:55:55.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22618 (GCVE-0-2023-22618)
Vulnerability from cvelistv5 – Published: 2023-10-04 00:00 – Updated: 2024-09-20 13:55
VLAI
EPSS
VEX
Summary
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-284 - Improper Access Control
Assigner
References
2 references
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| nokia | wavelite_metro_200_and_fan |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_and_fan:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ops_and_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ops_and_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_and_f2b_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ne_ops_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:* |
|
| nokia | wavelite_metro_200_ne_and_f2b_fans |
Affected:
0
cpe:2.3:h:nokia:wavelite_metro_200_ne_and_f2b_fans:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:13:49.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://nokia.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_and_fan:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_and_fan",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ops_and_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ops_and_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_ops_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:h:nokia:wavelite_metro_200_ne_ops_and_f2b_fans:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wavelite_metro_200_ne_ops_and_f2b_fans",
"vendor": "nokia",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T13:46:32.187988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T13:55:55.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-04T11:49:54.260Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://nokia.com"
},
{
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-22618",
"datePublished": "2023-10-04T00:00:00.000Z",
"dateReserved": "2023-01-04T00:00:00.000Z",
"dateUpdated": "2024-09-20T13:55:55.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}