Mbts Site Controller Firmware
CVE-2023-23774
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical access that is able to trigger such an exception to extract secret key material and/or gain arbitrary code execution on the device.
AnalysisAI
Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-248. Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical access that is able to trigger such an exception to extract secret key material and/or gain arbitrary code execution on the device. Affected products include: Motorola Ebts Site Controller Firmware, Motorola Mbts Site Controller Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Motorola MBTS Site Controller accepts hard-coded backdoor password. Rated critical severity (CVSS 9.8), this vulnerabili
Motorola MBTS Site Controller fails to check firmware update authenticity. Rated high severity (CVSS 8.8), this vulnerab
Same weakness CWE-248 – Uncaught Exception
View allShare
External POC / Exploit Code
Leaving vuln.today