CVEvulnerability
CVE-2023-22955
7.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2023-08-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-345
Description
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.
Affected configurations
• audiocodes 445hd firmware (<= 3.4.4.1000)
• audiocodes 405hd firmware (<= 3.4.4.1000)
• audiocodes c450hd firmware (<= 3.4.4.1000)
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2023/Aug/17 Mailing List, Third Party Advisory
- https://syss.de Not Applicable
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt Exploit, Vendor Advisory
- http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2023/Aug/17 Mailing List, Third Party Advisory
- https://syss.de Not Applicable
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt Exploit, Vendor Advisory