« Volver al listado

CVE-2023-23770

Estado: ModificadaCrítica (9.8)—

Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Motorola — Mbts Site Controller Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-23770",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-23770",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T14:35:53.927079Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cert@ncsc.nl",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cert@ncsc.nl",
      "affectedData": [
        {
          "vendor": "Motorola",
          "product": "MBTS Site Controller",
          "versions": [
            {
              "status": "affected",
              "version": "R05.32.58"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*"
          ],
          "vendor": "motorola",
          "product": "mbts_site_controller",
          "versions": [
            {
              "status": "affected",
              "version": "r05.32.58"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-29T09:15:07.993",
  "references": [
    {
      "url": "https://tetraburst.com/",
      "tags": [
        "Not Applicable"
      ],
      "source": "cert@ncsc.nl"
    },
    {
      "url": "https://tetraburst.com/",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cert@ncsc.nl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-259"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or disabled."
    },
    {
      "lang": "es",
      "value": "El Controlador de Sitio Motorola MBTS acepta una contraseña de puerta trasera codificada de forma rígida. La Interfaz Hombre-Máquina (MMI) del Controlador de Sitio Motorola MBTS, que permite a los técnicos de servicio diagnosticar y configurar el dispositivo, acepta una contraseña de puerta trasera codificada de forma rígida que no puede ser cambiada ni deshabilitada."
    }
  ],
  "lastModified": "2026-06-17T05:37:53.307",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:motorola:mbts_site_controller_firmware:r05.32.58:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87EB0F74-B3C6-4641-8678-1F8654BDFF8B"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:motorola:mbts_site_controller:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "044E6275-5F1D-496C-839F-909926D337B8"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cert@ncsc.nl"
}