Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-26943

The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.

Published

2023-10-19T10:15:09.963

Last Modified

2024-11-21T06:54:50.800

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-338
  • Type: Primary
    CWE-338
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System motorola mtm5500_firmware - Yes
Hardware motorola mtm5500 - No
Operating System motorola mtm5400_firmware - Yes
Hardware motorola mtm5400 - No
References