VAR-201307-0389
Vulnerability from variot - Updated: 2023-12-18 12:38The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE authentication, which makes it easier for remote attackers to obtain ESN and MIN values from arbitrary phones, and conduct cloning attacks, by sniffing the network for registration packets. iSEC Partners has reported that the Verizon Wireless Network Extender models SCS-26UC4 and SCS-2U01 made by Samsung are susceptible to a local compromise using a custom HDMI cable. Once compromised the device can be used to eavesdrop on voice, text and data communication for mobile devices that connect to the Network Extender. The Verizon Wireless Network Extender is a low-power cellular base station that provides Internet services using an Internet connection. The Verizon Wireless Network Extender has multiple security vulnerabilities to increase permissions or clone other user phones. Use a special console cable to connect to the device and submit a special command sequence to get the root shell. Use the SysReq (System Request) interrupt to gain access to the console and obtain the root shell. In addition, Network Extender does not use Cellular Authentication and Voice Encryption (CAVE) authentication. For mobile phone authentication, the device only uses ESN and MIN. These numbers can physically access the phone or sniff the registration message sent to Network Extender for acquisition. Defects and incorrect validation can be done by running custom code on the Network Extender and going to any phone's ESN and MIN, using these numbers to clone the phone without physical access. A local attacker exploits the vulnerability to escalate permissions and clones the phone. Attackers can use these vulnerabilities to execute arbitrary code with elevated privileges and take complete control of the device. This BID is being retired. This may aid in cloning a phone without direct physical access and without a user's knowledge
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201307-0389",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wireless network extender",
"scope": "eq",
"trust": 1.6,
"vendor": "verizon",
"version": "scs-2u01"
},
{
"model": "wireless network extender",
"scope": "eq",
"trust": 1.6,
"vendor": "verizon",
"version": "scs-26uc4"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "samsung",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "verizon",
"version": null
},
{
"model": "network extender",
"scope": "eq",
"trust": 0.8,
"vendor": "verizon",
"version": "scs-26uc4"
},
{
"model": "network extender",
"scope": "eq",
"trust": 0.8,
"vendor": "verizon",
"version": "scs-2u01"
},
{
"model": "wireless network extender models scs-26uc4",
"scope": null,
"trust": 0.6,
"vendor": "verizon",
"version": null
},
{
"model": "wireless network extender models scs-2u01",
"scope": null,
"trust": 0.6,
"vendor": "verizon",
"version": null
},
{
"model": "wireless network extender scs-2u01",
"scope": "eq",
"trust": 0.3,
"vendor": "verizon",
"version": "0"
},
{
"model": "wireless network extender scs-26uc4",
"scope": "eq",
"trust": 0.3,
"vendor": "verizon",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#458007"
},
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:verizon:wireless_network_extender:scs-2u01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:verizon:wireless_network_extender:scs-26uc4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-4877"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iSEC Partners",
"sources": [
{
"db": "BID",
"id": "61169"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
}
],
"trust": 0.9
},
"cve": "CVE-2013-4877",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 1.9,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2013-4877",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 1.9,
"id": "CNVD-2013-10005",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 1.9,
"id": "VHN-64879",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:H/AU:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-4877",
"trust": 1.8,
"value": "LOW"
},
{
"author": "CNVD",
"id": "CNVD-2013-10005",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201307-417",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-64879",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "VULHUB",
"id": "VHN-64879"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE authentication, which makes it easier for remote attackers to obtain ESN and MIN values from arbitrary phones, and conduct cloning attacks, by sniffing the network for registration packets. iSEC Partners has reported that the Verizon Wireless Network Extender models SCS-26UC4 and SCS-2U01 made by Samsung are susceptible to a local compromise using a custom HDMI cable. Once compromised the device can be used to eavesdrop on voice, text and data communication for mobile devices that connect to the Network Extender. The Verizon Wireless Network Extender is a low-power cellular base station that provides Internet services using an Internet connection. The Verizon Wireless Network Extender has multiple security vulnerabilities to increase permissions or clone other user phones. Use a special console cable to connect to the device and submit a special command sequence to get the root shell. Use the SysReq (System Request) interrupt to gain access to the console and obtain the root shell. In addition, Network Extender does not use Cellular Authentication and Voice Encryption (CAVE) authentication. For mobile phone authentication, the device only uses ESN and MIN. These numbers can physically access the phone or sniff the registration message sent to Network Extender for acquisition. Defects and incorrect validation can be done by running custom code on the Network Extender and going to any phone\u0027s ESN and MIN, using these numbers to clone the phone without physical access. A local attacker exploits the vulnerability to escalate permissions and clones the phone. Attackers can use these vulnerabilities to execute arbitrary code with elevated privileges and take complete control of the device. \nThis BID is being retired. This may aid in cloning a phone without direct physical access and without a user\u0027s knowledge",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CERT/CC",
"id": "VU#458007"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"db": "BID",
"id": "61169"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "VULHUB",
"id": "VHN-64879"
}
],
"trust": 4.05
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#458007",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2013-4877",
"trust": 2.8
},
{
"db": "BID",
"id": "61169",
"trust": 2.6
},
{
"db": "JVN",
"id": "JVNVU94014626",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2013-10005",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296",
"trust": 0.6
},
{
"db": "BID",
"id": "61393",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-64879",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#458007"
},
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "VULHUB",
"id": "VHN-64879"
},
{
"db": "BID",
"id": "61169"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"id": "VAR-201307-0389",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "VULHUB",
"id": "VHN-64879"
}
],
"trust": 1.5611111
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-10005"
}
]
},
"last_update_date": "2023-12-18T12:38:32.224000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Verizon Wireless Network Extender",
"trust": 0.8,
"url": "http://www.verizonwireless.com/b2c/device/network-extender"
},
{
"title": "Patch for multiple local privilege escalation vulnerabilities in the Verizon Wireless Network Extender",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/36382"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-64879"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.kb.cert.org/vuls/id/458007"
},
{
"trust": 2.5,
"url": "http://www.kb.cert.org/vuls/id/bluu-997m5b"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/61169"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4877"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu94014626/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4877"
},
{
"trust": 0.3,
"url": "http://www.verizonwireless.com/b2c/device/network-extender?"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#458007"
},
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "VULHUB",
"id": "VHN-64879"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#458007"
},
{
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"db": "VULHUB",
"id": "VHN-64879"
},
{
"db": "BID",
"id": "61169"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-07-15T00:00:00",
"db": "CERT/CC",
"id": "VU#458007"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"date": "2013-07-18T00:00:00",
"db": "VULHUB",
"id": "VHN-64879"
},
{
"date": "2013-07-15T00:00:00",
"db": "BID",
"id": "61169"
},
{
"date": "2013-07-15T00:00:00",
"db": "BID",
"id": "61393"
},
{
"date": "2013-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"date": "2013-07-18T16:51:40.403000",
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-07-23T00:00:00",
"db": "CERT/CC",
"id": "VU#458007"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-10005"
},
{
"date": "2013-08-22T00:00:00",
"db": "VULHUB",
"id": "VHN-64879"
},
{
"date": "2013-07-23T02:23:00",
"db": "BID",
"id": "61169"
},
{
"date": "2013-07-15T00:00:00",
"db": "BID",
"id": "61393"
},
{
"date": "2013-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-003461"
},
{
"date": "2013-08-22T06:54:39.957000",
"db": "NVD",
"id": "CVE-2013-4877"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"date": "2013-07-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "61169"
},
{
"db": "BID",
"id": "61393"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-296"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-417"
}
],
"trust": 1.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Verizon Wireless Network Extender multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#458007"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "61169"
},
{
"db": "BID",
"id": "61393"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…