CVE-2023-36669

CriticalCVSS 9.8

Published: 18/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

Missing authentication for a critical function within the Kratos NGC Indoor Unit (IDU) before version 11.4 allows remote attackers to gain arbitrary control over the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests.

Risk Assessment

This vulnerability poses a significant security risk to the system, allowing attackers to take control of critical functions. This could lead to unauthorized access and potential disruptions in system operation.

Recommendation

It is recommended to update the Kratos NGC Indoor Unit to version 11.4 or later to mitigate this vulnerability. Additionally, implementing further authentication mechanisms for critical system functions is advisable.

Original NVD description (English source)

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.