CVE-2023-36618
📋 TL;DR
CVE-2023-36618 allows authenticated low-privileged users to execute arbitrary operating system commands with root privileges on Atos Unify OpenScape Session Border Controller systems. This vulnerability affects all versions through V10 R3.01.03, enabling complete system compromise.
💻 Affected Systems
- Atos Unify OpenScape Session Border Controller
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, allowing attackers to install persistent backdoors, exfiltrate sensitive data, pivot to other network segments, or disrupt telephony services.
Likely Case
Attackers gain root shell access to execute arbitrary commands, potentially leading to data theft, service disruption, or lateral movement within the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the SBC device itself, though root compromise still allows significant damage to that system.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. Public exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V10 R3.01.04 and later
Vendor Advisory: https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
Restart Required: Yes
Instructions:
1. Download patch from Atos Unify support portal. 2. Backup current configuration. 3. Apply patch following vendor instructions. 4. Restart the SBC. 5. Verify patch installation and functionality.
🔧 Temporary Workarounds
Restrict Access Controls
allLimit network access to the SBC management interface to only trusted administrative networks and implement strict authentication controls.
Implement Network Segmentation
allIsolate the SBC in a dedicated network segment with strict firewall rules limiting inbound and outbound connections.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the SBC from critical infrastructure
- Enforce multi-factor authentication and strong password policies for all SBC accounts
🔍 How to Verify
Check if Vulnerable:
Check SBC version via web interface or CLI. If version is V10 R3.01.03 or earlier, the system is vulnerable.Check Version:
show versionVerify Fix Applied:
Verify version is V10 R3.01.04 or later via web interface or CLI command 'show version'.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Multiple failed authentication attempts followed by successful login
- Unexpected process execution or system modifications
Network Indicators:
- Unusual outbound connections from SBC
- Suspicious traffic patterns to/from SBC management interface
- Anomalous SSH or remote access attempts
SIEM Query:
source="openscape-sbc" AND (event_type="command_execution" OR event_type="privilege_escalation")🔗 References
- https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
- https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html
- https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/
- https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
- https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html
- https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/
