VulnerabilityModified

CVE-2023-22618

If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request.

HIGH 7.8EPSS 0.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: nokia/wavelite metro 200 and fan firmware · nokia/wavelite metro 200 ops and fans firmware · nokia/wavelite metro 200 and f2b fans firmware · nokia/wavelite metro 200 ops and f2b fans firmware · nokia/wavelite metro 200 ne and f2b fans firmware · nokia/wavelite metro 200 ne ops and f2b fans firmware
Source: cve@mitre.org

References

https://nokia.comProduct
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/Vendor Advisory
https://nokia.comProduct
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.