High severity · published Jan 6, 2023
CVE-2022-2483
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Asik Airscale 474021a.101 Firmware · Nokia
All versions, or not specified · source: NVD
AA
Asik Airscale 474021a.102 Firmware · Nokia
All versions, or not specified · source: NVD
Affected product
AA
Asik Airscale 474021a.101 Firmware
Nokia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2483
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2483
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
More from Asik Airscale 474021a.101 Firmware
8.8
CVE-2022-2482
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible…
7.8
CVE-2022-2484
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware