« Volver al listado

CVE-2022-26942

Estado: ModificadaAlta (8.2)—

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Motorola — Mtm5400 FirmwareMotorola — Mtm5500 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-26942",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-26942",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-15T16:23:58.876138Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cert@ncsc.nl",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "cert@ncsc.nl",
      "affectedData": [
        {
          "vendor": "Motorola",
          "product": "Mobile Radio",
          "versions": [
            {
              "status": "affected",
              "version": "MTM5000"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:motorola:mtm5000_series_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "motorola",
          "product": "mtm5000_series_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-10-19T10:15:09.913",
  "references": [
    {
      "url": "https://tetraburst.com/",
      "tags": [
        "Technical Description"
      ],
      "source": "cert@ncsc.nl"
    },
    {
      "url": "https://tetraburst.com/",
      "tags": [
        "Technical Description"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cert@ncsc.nl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-822"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-763"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives."
    },
    {
      "lang": "es",
      "value": "Los firmwares de la serie Motorola MTM5000 carecen de validación de puntero en los argumentos pasados a los módulos Trusted Execution Environment (TEE). Se utilizan dos módulos, uno responsable de la gestión de claves KVL y el otro de la funcionalidad criptográfica TETRA. En ambos módulos, un adversario con una ejecución de código de nivel de supervisor no segura puede aprovechar el problema para obtener una ejecución segura de código de supervisor dentro del TEE. Esto constituye una ruptura total del módulo TEE, exponiendo la clave del dispositivo, así como cualquier clave criptográfica TETRA y las primitivas criptográficas TETRA confidenciales."
    }
  ],
  "lastModified": "2026-06-17T04:36:12.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A1A0784B-AE84-4457-A884-5C26EEA8D181"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF669A29-B983-40F6-BBA9-D9F67E653BEF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "03AA5A43-A1B5-4E1C-A844-691607765E30"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cert@ncsc.nl"
}