CVE-2023-36619
📋 TL;DR
CVE-2023-36619 allows unauthenticated remote attackers to execute administrative scripts on Atos Unify OpenScape Session Border Controller systems. This vulnerability affects all deployments running vulnerable versions, potentially giving attackers full control over the SBC device.
💻 Affected Systems
- Atos Unify OpenScape Session Border Controller
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the SBC allowing attackers to intercept/modify VoIP traffic, pivot to internal networks, deploy ransomware, or use the device for further attacks.
Likely Case
Remote code execution leading to data exfiltration, service disruption, or use as a foothold for lateral movement within the network.
If Mitigated
Limited impact if device is isolated with strict network segmentation and access controls, though still vulnerable to internal threats.
🎯 Exploit Status
Public exploit code available on Packet Storm Security and other sources. Attack requires only network access to the SBC management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V10 R3.01.04 or later
Vendor Advisory: https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
Restart Required: Yes
Instructions:
1. Download patch from Atos Unify support portal. 2. Backup current configuration. 3. Apply patch following vendor instructions. 4. Reboot device. 5. Verify patch installation and functionality.
🔧 Temporary Workarounds
Network Isolation
allRestrict access to SBC management interface to trusted IPs only
Configure firewall rules to allow only specific management IPs to access SBC management ports
Management Interface Removal
allDisable or remove management interface from untrusted networks
Configure SBC to only allow management from internal VLAN/network
🧯 If You Can't Patch
- Immediately isolate the SBC from internet and untrusted networks using firewall rules
- Implement strict network segmentation and monitor all traffic to/from the SBC for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check SBC version via web interface or CLI. If version is V10 R3.01.03 or earlier, device is vulnerable.Check Version:
Login to SBC CLI and run 'show version' or check via web interface System InformationVerify Fix Applied:
Verify version is V10 R3.01.04 or later. Test that unauthenticated access to administrative scripts is blocked.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to administrative scripts
- Unusual script execution patterns
- Failed authentication followed by successful script execution
Network Indicators:
- Unusual traffic to SBC management ports from unexpected sources
- HTTP requests to administrative script endpoints without authentication headers
SIEM Query:
source="SBC_logs" AND (uri="*/admin_scripts/*" OR uri="*/cgi-bin/*") AND NOT auth_success="true"🔗 References
- https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
- https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html
- https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/
- https://networks.unify.com/security/advisories/OBSO-2307-01.pdf
- https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html
- https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/
