CVE-2023-23773 Security feature bypass in EBTS/MBTS Base Radio
An authenticated attacker can bypass firmware signature checks to execute arbitrary code and extract secrets on Motorola base radios.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23773?
CVE-2023-23773 is a high-severity vulnerability in Motorola EBTS/MBTS Base Radio, published on 29 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a persistent implant on the device.
Weakness: CWE-347
Which versions are affected by CVE-2023-23773?
It affects 2 products.
Products include Motorola Ebts Base Radio Firmware, Motorola Mbts Base Radio Firmware.
How do I fix CVE-2023-23773?
No fix has been published for CVE-2023-23773 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-23773 being exploited?
There is no known exploitation of CVE-2023-23773 in the wild and no public exploit code.
Sources
Also known as GHSA-74wm-8c3j-gw64.