7.5

CVE-2023-22957

Exploit
An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Audiocodes ≫ C470hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ C470hd Version -
Audiocodes ≫ C455hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ C455hd Version -
Audiocodes ≫ C435hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ C435hd Version -
Audiocodes ≫ 445hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ 445hd Version -
Audiocodes ≫ 405hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ 405hd Version -
Audiocodes ≫ C450hd Firmware Version <= 3.4.4.1000
   Audiocodes ≫ C450hd Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.36% 0.691
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://syss.de
Not Applicable
http://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/15
Third Party Advisory
Exploit
Mailing List
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txt
Vendor Advisory
Exploit