CVE-2023-30024

Katalog CVE

CVSS 6.6 · Medium EPSS 0,47%

Kerentanan Improper Privilege Management pada magicjack a921 firmware. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4.

Rincian

Terbit di NVD

28 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pastebin.com/raw/irWcawp8 advisory pihak ketiga
• https://samuraisecurity.co.uk/red-teaming-0x01-click-rce-via-voip-usb/ exploit · deskripsi teknis · advisory pihak ketiga
• https://drive.google.com/drive/folders/1cKd8hksThK610GPtBQ3du8DEkwKywlAi?usp=sharing exploit
• https://www.magicjack.com/ product