CVE-2023-31280 Exposure of Sensitive Information to an Unauthorized Actor
Attackers can bulk enumerate IMEI and Serial Number pairs via the AirVantage Warranty Checker, exposing sensitive device identifiers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31280?
CVE-2023-31280 is a medium-severity vulnerability in AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices., published on 20 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial Number in addition to the warranty status when the Serial Number or IMEI is used to look up warranty status.
Weakness: CWE-200
Which versions are affected by CVE-2023-31280?
How do I fix CVE-2023-31280?
No fix has been published for CVE-2023-31280 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31280 being exploited?
There is no known exploitation of CVE-2023-31280 in the wild and no public exploit code.
Sources
Also known as GHSA-c3vh-vj4j-ph6x.