CVE-2023-6269
Critical
Description
An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.
SeverityCritical
CVSS10.0
Exploit probability—
ProductAtos Unify Openscape Bcf
PublishedDec 5, 2023
First seenDec 5, 2023
Weakness typeCWE-88CWE-88
How to fix
Update
- atos unify_openscape_bcf10r10.12.00 or later
- atos unify_openscape_branch10r3.4.0 or later
- atos unify_openscape_session_border_controller10r3.4.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atos unify_openscape_bcf | 10 ≤ v < 10r10.12.00 | 10r10.12.00 |
| atos unify_openscape_branch | 10 ≤ v < 10r3.4.0 | 10r3.4.0 |
| atos unify_openscape_session_border_controller | 10 ≤ v < 10r3.4.0 | 10r3.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.