u-blox TOBY-L200/TOBY-L201/TOBY-L210/TOBY-L220/TOBY-L280 up to 80 AT Command input validation

Summaryinfo

A vulnerability described as critical has been identified in u-blox TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220 and TOBY-L280 00/01/10/20/80. This affects an unknown function of the component AT Command Handler. Such manipulation leads to input validation. This vulnerability is listed as CVE-2023-0011. The attack can be executed directly on the physical device. There is no available exploit.

Detailsinfo

A vulnerability was found in u-blox TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220 and TOBY-L280 00/01/10/20/80. It has been rated as critical. Affected by this issue is an unknown code block of the component AT Command Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands. Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well.. This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.

The weakness was presented 12/20/2023. The advisory is available at u-blox.com. This vulnerability is handled as CVE-2023-0011 since 12/12/2022. The technical details are unknown and an exploit is not available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• u-blox

Name

• TOBY-L200
• TOBY-L201
• TOBY-L210
• TOBY-L220
• TOBY-L280

Version

• 00
• 01
• 10
• 20
• 80

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion