Products
Alpine Halo9
Source
cve@asrg.io
Tags
CVE-2024-23960 details
Last Modified : Sept. 28, 2024, 7:15 a.m.
Description
Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validation mechanism on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware metadata signature validation mechanism. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23102
CVSS Score
| 1 | 2 | 3 | 4.6 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
CVSS Data
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
4.6
Exploitability Score
0.9
Impact Score
3.6
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
| URL | Source |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-845/ | cve@asrg.io |