CVE-2023-30312
First published: Tue May 28 2024(Updated: )
An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server (e.g., for access to files over FTP), and impersonating the server to the client (e.g., to deliver false information from a finance website). This occurs because nf_conntrack_tcp_no_window_check is true by default.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open edX | >=18.06<=22.03 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/
- https://openwrt.org/docs/guide-developer/security
- https://blog.apnic.net/2024/06/18/off-path-tcp-hijacking-in-nat-enabled-wi-fi-networks/
- https://news.ycombinator.com/item?id=40723150
Frequently Asked Questions
What is the severity of CVE-2023-30312?
CVE-2023-30312 has been classified as a high severity vulnerability due to its potential to allow off-path attackers to hijack TCP sessions.
How do I fix CVE-2023-30312?
To mitigate CVE-2023-30312, it is recommended to update OpenWrt to the latest version that addresses the vulnerability.
What versions of OpenWrt are affected by CVE-2023-30312?
CVE-2023-30312 affects OpenWrt versions from 18.06 to 22.03 and beyond.
What are the potential impacts of CVE-2023-30312?
The impacts of CVE-2023-30312 include denial of service and the ability for attackers to impersonate both clients and servers.
Can CVE-2023-30312 lead to data breaches?
Yes, CVE-2023-30312 can potentially lead to data breaches as attackers may impersonate clients to access files over FTP.
- agent/type
- agent/author
- agent/references
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openwrt
- canonical/open edx