CVE-2021-3460 Security feature bypass in MH702x
Attackers can intercept and manipulate traffic between Motorola MH702x devices and support servers due to missing certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3460?
CVE-2021-3460 is a high-severity vulnerability in Motorola MH702x, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.
Weakness: CWE-295
Which versions are affected by CVE-2021-3460?
It affects 1 product.
Products include Motorola Mh702x Firmware.
How do I fix CVE-2021-3460?
No fix has been published for CVE-2021-3460 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-3460 being exploited?
There is no known exploitation of CVE-2021-3460 in the wild and no public exploit code.
Sources
Also known as GHSA-4487-5mj9-g5r6.