CVE-2023-35830
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
STW TCG-4 and TCG-4lite connectivity modules allow an attacker to gain full remote access with root privileges without the need for authentication. An attacker can execute arbitrary remote code over LTE / 4G network via SMS.
Risk Assessment
Organizations using these modules are exposed to serious threats as attackers can take control of the system without any security measures. This could lead to data loss and compromise of system integrity.
Recommendation
It is recommended to immediately update the connectivity modules to the latest version to mitigate this vulnerability. Additionally, implement further security measures to restrict access to the systems.
Original NVD description (English source)
STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.