CVE-2023-22618
Last modified
CVE-2023-22618 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nokia | Wavelite Metro 200 And Fan Firmware | < r2.1.1 |
| Nokia | Wavelite Metro 200 Ops And Fans Firmware | < r2.1.1 |
| Nokia | Wavelite Metro 200 And F2b Fans Firmware | < r2.1.1 |
| Nokia | Wavelite Metro 200 Ops And F2b Fans Firmware | < r2.1.1 |
| Nokia | Wavelite Metro 200 Ne And F2b Fans Firmware | < r2.1.1 |
| Nokia | Wavelite Metro 200 Ne Ops And F2b Fans Firmware | < r2.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-22618?
How severe is CVE-2023-22618?
How do I fix CVE-2023-22618?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22612An issue was discovered in IhisiSmm in Insyde InsydeH2O with…8.8
- CVE-2023-22613An issue was discovered in IhisiSmm in Insyde InsydeH2O with…8.8
- CVE-2023-22614An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O…8.8
- CVE-2023-22615An issue was discovered in IhisiSmm in Insyde InsydeH2O with…8.4
- CVE-2023-22616An issue was discovered in Insyde InsydeH2O with kernel 5.2 …7.8
- CVE-2023-22617A remote attacker might be able to cause infinite recursion …7.5
- CVE-2023-2262 A buffer overflow vulnerability exists in the Rockwell Au…9.8
- CVE-2023-22620An issue was discovered in SecurePoint UTM before 12.2.5.1. …7.5
- CVE-2023-22621Strapi through 4.5.5 allows authenticated Server-Side Templa…7.2
- CVE-2023-22622WordPress through 6.1.1 depends on unpredictable client visi…5.3
- CVE-2023-22624Zoho ManageEngine Exchange Reporter Plus before 5708 allows …7.5
- CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAI…7.5
Are you affected by CVE-2023-22618?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST