VulnerabilityAnalyzed
CVE-2023-31728
Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.
HIGH 7.0EPSS 0.20%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.
- CVSS 3.1
- 7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.20% probability · 10th percentile
- CISA KEV
- Not listed
- Affected
- teltonika-networks/rut240 firmware
- Source
- cve@mitre.org
References
- https://research.exoticsilicon.com/articles/lte_ethernet_bridge_bug_followupThird Party Advisory
- https://research.exoticsilicon.com/newsThird Party Advisory
- https://research.exoticsilicon.com/articles/lte_ethernet_bridge_bug_followupThird Party Advisory
- https://research.exoticsilicon.com/newsThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.