VulnerabilityModified
CVE-2023-23119
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks.
MEDIUM 5.9EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-354
- Affected
- ui/af-2x firmware
- Source
- cve@mitre.org
References
- https://community.ui.com/tags/security/releasesVendor Advisory
- https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SkYce4f5oExploit, Third Party Advisory
- https://community.ui.com/tags/security/releasesVendor Advisory
- https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SkYce4f5oExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.