CVE-2023-22957

HIGH

AudioCodes C470HD C455HD C435HD 445HD 405HD C450HD Firmware < 3.4.4.1000 - Use of Hard-coded Cryptographic Key

Title source: llm
STIX 2.1

Description

An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.

References (4)

Core 4
Core References
Not Applicable
https://syss.de
Exploit, Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2023/Aug/15

Scores

CVSS v3 7.5
EPSS 0.0113
EPSS Percentile 62.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-798
Status published
Products (6)
audiocodes/405hd_firmware < 3.4.4.1000
audiocodes/445hd_firmware < 3.4.4.1000
audiocodes/c435hd_firmware < 3.4.4.1000
audiocodes/c450hd_firmware < 3.4.4.1000
audiocodes/c455hd_firmware < 3.4.4.1000
audiocodes/c470hd_firmware < 3.4.4.1000
Published Aug 11, 2023
Tracked Since Feb 18, 2026