CVE-2023-30312: High severity OpenWrt OpenWrt vulnerability
An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server (e.g., for access to files over FTP), and impersonating the server to the client (e.g., to deliver false information from a finance website). This occurs because nfconntracktcpnowindowcheck is true by default.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30312?
CVE-2023-30312 has been classified as a high severity vulnerability due to its potential to allow off-path attackers to hijack TCP sessions.
How do I fix CVE-2023-30312?
To mitigate CVE-2023-30312, it is recommended to update OpenWrt to the latest version that addresses the vulnerability.
What versions of OpenWrt are affected by CVE-2023-30312?
CVE-2023-30312 affects OpenWrt versions from 18.06 to 22.03 and beyond.
What are the potential impacts of CVE-2023-30312?
The impacts of CVE-2023-30312 include denial of service and the ability for attackers to impersonate both clients and servers.
Can CVE-2023-30312 lead to data breaches?
Yes, CVE-2023-30312 can potentially lead to data breaches as attackers may impersonate clients to access files over FTP.