Sign-up

ID

VAR-202307-2109


CVE

CVE-2023-33745


TITLE

TeleAdapt RoomCast TA-2400 Privilege Escalation Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2023-61013

DESCRIPTION

TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering the su command provides root access (without requiring a password). The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained premium content streaming box for guest rooms from TeleAdapt UK. An escalation of privilege vulnerability exists in TeleAdapt RoomCast TA-2400, which is caused by improper permission management of Android Debug Bridge (ADB). An attacker could exploit this vulnerability to gain elevated root privileges

Trust: 1.44

sources: NVD: CVE-2023-33745 // CNVD: CNVD-2023-61013

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-61013

AFFECTED PRODUCTS

vendor:teleadaptmodel:roomcast ta-2400scope:lteversion:3.1

Trust: 1.0

vendor:teleadaptmodel:roomcast ta-2400scope:gteversion:1.0

Trust: 1.0

vendor:teleadaptmodel:roomcast ta-2400scope:gteversion:1.0,<=3.1

Trust: 0.6

sources: CNVD: CNVD-2023-61013 // NVD: CVE-2023-33745

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-33745
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2023-61013
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-61013
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-33745
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2023-61013 // NVD: CVE-2023-33745

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.0

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2023-33745

EXTERNAL IDS

db:PACKETSTORMid:173764

Trust: 1.7

db:NVDid:CVE-2023-33745

Trust: 1.7

db:CNVDid:CNVD-2023-61013

Trust: 0.6

sources: CNVD: CNVD-2023-61013 // PACKETSTORM: 173764 // NVD: CVE-2023-33745

REFERENCES

url:http://packetstormsecurity.com/files/173764/roomcast-ta-2400-cleartext-private-key-improper-access-control.html

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2023-33743

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-33744

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-33745

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-33742

Trust: 0.1

sources: CNVD: CNVD-2023-61013 // PACKETSTORM: 173764 // NVD: CVE-2023-33745

CREDITS

Calvin Star, Austin Henderson, Nolia Red

Trust: 0.1

sources: PACKETSTORM: 173764

SOURCES

db:CNVDid:CNVD-2023-61013
db:PACKETSTORMid:173764
db:NVDid:CVE-2023-33745

LAST UPDATE DATE

2024-10-23T22:43:44.506000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-61013date:2023-08-03T00:00:00
db:NVDid:CVE-2023-33745date:2024-10-23T15:35:12.013

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-61013date:2023-08-04T00:00:00
db:PACKETSTORMid:173764date:2023-07-26T14:34:30
db:NVDid:CVE-2023-33745date:2023-07-27T21:15:13.850