CVE-2021-3460

The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.

CVSS v3 8.1 HIGH
CVSS v2.0 7.5 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249	Vendor Advisory
https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:motorola:mh702x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mh702x:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:21

Type	Values Removed	Values Added
References	~~() https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249 - Vendor Advisory~~	() https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249 - Vendor Advisory
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 8.1

Information

Published : 2021-04-13 21:15

Updated : 2024-11-21 06:21

NVD link : CVE-2021-3460

Mitre link : CVE-2021-3460

CVE.ORG link : CVE-2021-3460

JSON object : View

Products Affected

motorola

mh702x
mh702x_firmware

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2021-3460", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-04-13T21:15:25.037", "references": [{"url": "https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "https://motorolamentor.zendesk.com/hc/en-us/articles/1260804087249", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@lenovo.com", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker."}, {"lang": "es", "value": "Los dispositivos Motorola MH702x, anteriores a versi\u00f3n 2.0.0.301, no verifican apropiadamente el certificado del servidor durante la comunicaci\u00f3n con el servidor de soporte, lo que podr\u00eda conllevar que un canal de comunicaci\u00f3n sea accedido por un atacante"}], "lastModified": "2024-11-21T06:21:35.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mh702x_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "638069D4-50A2-47FF-957A-75294EAF99CF", "versionEndExcluding": "2.0.0.301"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mh702x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "034DBE0E-A4C7-4BB9-8DCC-AA0325BC5036"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@lenovo.com"}