CVE-2023-43478

Unauthenticated configuration restore and firmware update

High · published September 20, 2023

CVSS v3.1
8.8
EPSS
18%
Percentile
97.2
In the wild
Unconfirmed
What it is

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17954 · 97.2th percentile
Published
2023-09-20T13:03Z
EPSS history
Timeline
  • 20 SEP 13:03Z
    Unauthenticated configuration restore and firmware update
    cvelistv5