CVE-2022-2483 - The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature

Back Back to CVE browser

HIGH

The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature

Published Jan 6, 2023

8.4

HIGH

CVSS 3.1

EPSS 0.22%

Description

The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.

Affected products

Vendor Nokia Product ASIK AirScale Default
unaffected
- Version
  474021A.101
  Status
  affected
  Constraints
  -
- Version
  474021A.102
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nokia

ASIK AirScale

unaffected

Version	Status	Constraints
474021A.101	affected	-
474021A.102	affected	-

Remediation

Vendor solution

Nokia has released technical support notes containing mitigation instructions for impacted Nokia users. Users should contact Nokia https://customer.nokia.com/support/s/ to receive further information.

Weaknesses (1)

CWE-1282

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34742
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
government-resourceThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34742		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02		government-resourceThird Party AdvisoryUS Government Resource