CVE-2022-26942: Multiple missing pointer validation checks in trusted execution module in Motorola MTM5000
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Motorola MTM5000 series firmware vulnerability?
The vulnerability ID for this Motorola MTM5000 series firmware vulnerability is CVE-2022-26942.
What is the severity of CVE-2022-26942?
The severity of CVE-2022-26942 is high with a severity value of 8.2.
Which software versions are affected by CVE-2022-26942?
The Motorola Mtm5500 Firmware and Motorola Mtm5400 Firmware are affected by CVE-2022-26942.
What is the CWE ID of CVE-2022-26942?
The CWE ID of CVE-2022-26942 is 763.
How can I fix the vulnerability in Motorola MTM5000 series firmware?
To fix the vulnerability, it is recommended to apply the latest firmware updates provided by Motorola.