CVE-2022-30273

CRITICAL9.8

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity

Published Jul 26, 2022

Modified 1 years ago

No fix available

Details

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.

References

WEBhttps://en.wikipedia.org/wiki/Block_cipher_mode_of_operation WEBhttps://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2022-30273 WEBhttps://www.forescout.com/blog/

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedJul 26, 2022

ModifiedAug 3, 2024