The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.
oryginał ENCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMotorola Mtm5400
HWMotorolawszystkie wersjeMotorola Mtm5400 Firmware
OSMotorolawszystkie wersjeMotorola Mtm5500
HWMotorolawszystkie wersjeMotorola Mtm5500 Firmware
OSMotorolawszystkie wersje
Powiązane podatności
A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL co...
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environ...
Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-...
Command injection w parametrze SaveSysLogParams routera Motorola MR2600
Command injection w parametrze SaveStaticRouteIPv4Params routera Motorola MR2600