HIGH🇵🇱 Wersja polska

CVE-2022-26942

CVSS 8.2v3.1pub. 2023-10-19upd. 2024-11-21

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Motorola Mtm5400

    HW
    Motorola
    wszystkie wersje

  • Motorola Mtm5400 Firmware

    OS
    Motorola
    wszystkie wersje

  • Motorola Mtm5500

    HW
    Motorola
    wszystkie wersje

  • Motorola Mtm5500 Firmware

    OS
    Motorola
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-26941CRITICAL9.6ten sam produkt

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL co...

CVE-2022-26943HIGH8.8ten sam produkt

The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count...

CVE-2022-27813HIGH8.1ten sam produkt

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-...

CVE-2024-23626CRITICAL9.0PL ✓ten sam vendor

Command injection w parametrze SaveSysLogParams routera Motorola MR2600

CVE-2024-23627CRITICAL9.0PL ✓ten sam vendor

Command injection w parametrze SaveStaticRouteIPv4Params routera Motorola MR2600