CVE-2023-22618 – This vulnerability in Nokia WaveLite products a... (How to Fix)

Q: What is the severity of CVE-2023-22618?

CVE-2023-22618 has a CVSS score of 8.1 (HIGH). This vulnerability in Nokia WaveLite products allows local users to create new administrative accounts by manipulating web requests when security hardening guidelines aren't followed. It affects multiple WaveLite Metro 200 models and related fan units. The issue stems from improper access control that fails to restrict user creation privileges.

📋 TL;DR

This vulnerability in Nokia WaveLite products allows local users to create new administrative accounts by manipulating web requests when security hardening guidelines aren't followed. It affects multiple WaveLite Metro 200 models and related fan units. The issue stems from improper access control that fails to restrict user creation privileges.

💻 Affected Systems

Products:

WaveLite Metro 200 and Fan
WaveLite Metro 200 OPS and Fans
WaveLite Metro 200 and F2B fans
WaveLite Metro 200 OPS and F2B fans
WaveLite Metro 200 NE and F2B fans
WaveLite Metro 200 NE OPS and F2B fans

Versions: All versions prior to security hardening implementation

Operating Systems: Embedded systems in Nokia WaveLite products

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability only exists when Security Hardening guide rules are not followed. Properly hardened configurations are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker with local access gains full administrative control over the device, enabling complete system compromise, data exfiltration, and potential use as a pivot point into the network.

🟠

Likely Case

Local users escalate privileges to administrative level, allowing them to modify configurations, access sensitive data, and potentially disrupt network services.

🟢

If Mitigated

With proper security hardening and access controls, the vulnerability is prevented as the hardening guide specifically addresses this configuration weakness.

🌐 Internet-Facing: LOW - The vulnerability requires local access to the device's web interface, not directly exploitable from the internet.

🏢 Internal Only: HIGH - Local network access to the device's management interface is sufficient for exploitation by authenticated or potentially unauthenticated local users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires manipulating web requests to the device's local interface. The CWE-284 (Improper Access Control) classification indicates this is an authorization bypass issue.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: N/A - Configuration-based fix

Vendor Advisory: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/

Restart Required: No

Instructions:

1. Access the Nokia Security Hardening guide for WaveLite products. 2. Implement all recommended security hardening measures. 3. Specifically ensure proper access controls are configured to prevent unauthorized user creation. 4. Verify configuration changes are applied and effective.

🔧 Temporary Workarounds

Implement Security Hardening

all

Apply all security hardening guidelines from Nokia to restrict access and prevent unauthorized user creation

Network Segmentation

all

Restrict network access to WaveLite management interfaces to authorized administrative networks only

🧯 If You Can't Patch

Implement strict network access controls to limit who can reach the WaveLite management interfaces
Enable detailed logging and monitoring of user creation activities and web request patterns

🔍 How to Verify

Check if Vulnerable:

Check if Security Hardening guide rules have been implemented. Attempt to create a new administrative user via web interface manipulation (test in controlled environment only).

Check Version:

Check device configuration against Nokia's Security Hardening guide requirements

Verify Fix Applied:

Verify security hardening measures are in place. Test that user creation requests from non-administrative contexts are properly rejected.

📡 Detection & Monitoring

Log Indicators:

Unexpected user creation events
Web requests attempting to create administrative accounts
Failed authentication followed by successful privilege escalation

Network Indicators:

Unusual web traffic patterns to device management interfaces
Requests to user creation endpoints from unauthorized sources

SIEM Query:

source="wavelite-logs" AND (event_type="user_creation" OR uri_path="/create_user" OR uri_path="/admin/create")

📊 Metadata

CVE ID: CVE-2023-22618

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-284

Published: October 4, 2023

Last Updated: November 21, 2024

🔗 References

https://nokia.com Product
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/ Vendor Advisory
https://nokia.com Product
https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/ Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-22618, you might also want to check these: