A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to elevate privileges to "manufacturer" level on the targeted system.
| Version | Base score | Base severity | Vector |
|---|---|---|---|
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CAPEC ID | Description |
|---|
Telit Cinterion has released firmware updates to fix the issue. Contact Telit Cinterion for assistance.
Enforce application signature verification to prohibit the installation of untrusted MIDlets on the device.
Control physical access to the device at all stages of transportation to protect against the embedding of backdoors.
| Event | Date |
|---|---|
| Issue discovered by Kaspersky ICS CERT | 2023-02-21 12:45:00 |
| Confirmed by Telit Cinterion | 2023-04-27 15:56:00 |
| Hyperlink | Resource |
|---|---|
| https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-216-telit-cinterion-thales-gemalto-modules-improper-privilege-management-vulnerability/ | third-party-advisory |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-216-telit-cinterion-thales-gemalto-modules-improper-privilege-management-vulnerability/ | third-party-advisory x_transferred |