CVE-2023-31280 (GCVE-0-2023-31280)

Vulnerability from cvelistv5 – Published: 2024-12-20 23:41 – Updated: 2024-12-24 00:39
VLAI?
Summary
An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial Number in addition to the warranty status when the Serial Number or IMEI is used to look up warranty status.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
SWI
References
Impacted products
Vendor Product Version
Sierra Wireless AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices. Affected: All Sierra Wireless devices. (Custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-31280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-24T00:35:33.762558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-24T00:39:59.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.",
          "vendor": "Sierra Wireless",
          "versions": [
            {
              "status": "affected",
              "version": "All Sierra Wireless devices.",
              "versionType": "Custom"
            }
          ]
        }
      ],
      "datePublic": "2023-05-12T22:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \nwarranty status."
            }
          ],
          "value": "An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \nwarranty status."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Availability of IMEI and Serial Numbers pairs."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-20T23:41:22.070Z",
        "orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
        "shortName": "SWI"
      },
      "references": [
        {
          "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of Sensitive Information to an Unauthorized Actor",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
    "assignerShortName": "SWI",
    "cveId": "CVE-2023-31280",
    "datePublished": "2024-12-20T23:41:22.070Z",
    "dateReserved": "2023-04-26T19:52:55.324Z",
    "dateUpdated": "2024-12-24T00:39:59.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \\nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \\nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \\nwarranty status.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la herramienta de verificaci\\u00f3n de garant\\u00eda en l\\u00ednea de AirVantage podr\\u00eda permitir que un atacante realice una enumeraci\\u00f3n masiva de pares de IMEI y n\\u00fameros de serie. La herramienta de verificaci\\u00f3n de garant\\u00eda de AirVantage se ha actualizado para que ya no muestre el IMEI y el n\\u00famero de serie adem\\u00e1s del estado de la garant\\u00eda cuando se utiliza el n\\u00famero de serie o el IMEI para buscar el estado de la garant\\u00eda.\"}]",
      "id": "CVE-2023-31280",
      "lastModified": "2024-12-21T00:15:27.603",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@sierrawireless.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-12-21T00:15:27.603",
      "references": "[{\"url\": \"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/\", \"source\": \"security@sierrawireless.com\"}]",
      "sourceIdentifier": "security@sierrawireless.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@sierrawireless.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-31280\",\"sourceIdentifier\":\"security@sierrawireless.com\",\"published\":\"2024-12-21T00:15:27.603\",\"lastModified\":\"2024-12-21T00:15:27.603\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \\nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \\nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \\nwarranty status.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la herramienta de verificaci\u00f3n de garant\u00eda en l\u00ednea de AirVantage podr\u00eda permitir que un atacante realice una enumeraci\u00f3n masiva de pares de IMEI y n\u00fameros de serie. La herramienta de verificaci\u00f3n de garant\u00eda de AirVantage se ha actualizado para que ya no muestre el IMEI y el n\u00famero de serie adem\u00e1s del estado de la garant\u00eda cuando se utiliza el n\u00famero de serie o el IMEI para buscar el estado de la garant\u00eda.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@sierrawireless.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security@sierrawireless.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/\",\"source\":\"security@sierrawireless.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-31280\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-24T00:35:33.762558Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-24T00:35:35.189Z\"}}], \"cna\": {\"title\": \"Exposure of Sensitive Information to an Unauthorized Actor\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Availability of IMEI and Serial Numbers pairs.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Sierra Wireless\", \"product\": \"AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.\", \"versions\": [{\"status\": \"affected\", \"version\": \"All Sierra Wireless devices.\", \"versionType\": \"Custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2023-05-12T22:28:00.000Z\", \"references\": [{\"url\": \"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \\nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \\nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \\nwarranty status.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An AirVantage online Warranty Checker tool vulnerability could allow an attacker to \\nperform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial \\nNumber in addition to the warranty status when the Serial Number or IMEI is used to look up \\nwarranty status.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"747bec18-acd0-4d99-a5c8-5e366c66ab7e\", \"shortName\": \"SWI\", \"dateUpdated\": \"2024-12-20T23:41:22.070Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-31280\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-24T00:39:59.493Z\", \"dateReserved\": \"2023-04-26T19:52:55.324Z\", \"assignerOrgId\": \"747bec18-acd0-4d99-a5c8-5e366c66ab7e\", \"datePublished\": \"2024-12-20T23:41:22.070Z\", \"assignerShortName\": \"SWI\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.