High severity · published Jan 6, 2023
CVE-2022-2484
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Asik Airscale 474021a.101 Firmware · Nokia
All versions, or not specified · source: NVD
Affected product
AA
Asik Airscale 474021a.101 Firmware
Nokia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2484
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
More from Asik Airscale 474021a.101 Firmware
8.8
CVE-2022-2482
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible…
7.1
CVE-2022-2483
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature