CVE-2022-43501 Weak cryptography in Kasago IPv4
Attackers can predict TCP Initial Sequence Numbers to hijack connections or spoof traffic in KASAGO TCP/IP stacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43501?
CVE-2022-43501 is a critical vulnerability in ZUKEN Elmic Kasago IPv4, published on 10 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may be able to determine the ISN of the current or future TCP connections and either hijack existing ones or spoof future ones.
Weakness: CWE-330
Which versions are affected by CVE-2022-43501?
It affects 4 products.
Products include Elwsc Kasago Ipv4, Elwsc Kasago Ipv4 Light, Elwsc Kasago Ipv6\/V4 Dual, Elwsc Kasago Mobile Ipv6.
How do I fix CVE-2022-43501?
No fix has been published for CVE-2022-43501 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-43501 being exploited?
There is no known exploitation of CVE-2022-43501 in the wild and no public exploit code.
Sources
Also known as GHSA-96qq-9h7m-67pw.