CVE-2023-41355: chunghwa telecom nokia g-040w-q

Vulnerability summary

CVE-2023-41355 is a critical (CVSS 9.8) vulnerability in chunghwa telecom nokia g-040w-q. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.

Timeline

1. 03-11-2023
   PublishedVulnerability first disclosed.
2. 14-10-2024
   Last modifiedVulnerability information updated.

Description

Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.

• CWE-940Improper Verification of Source of a Communication ChannelThe product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.