High severity · published Aug 29, 2023
CVE-2023-23774
Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical access that is able to trigger such an exception to extract secret key material and/or gain arbitrary code execution on the device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Ebts Site Controller Firmware · Motorola
All versions, or not specified · source: NVD
MS
Mbts Site Controller Firmware · Motorola
All versions, or not specified · source: NVD