CVE-2023-36483: MAS (a Carrier brand) MASmobile Classic Authorization Bypass

Q: What is the severity of CVE-2023-36483?

The severity of CVE-2023-36483 is rated as high due to its potential for authorization bypass and data exposure.

Q: How do I fix CVE-2023-36483?

To fix CVE-2023-36483, update to MASmobile Classic Android version 1.16.19 or later and MASmobile Classic iOS version 1.7.25 or later.

Q: What types of data are affected by CVE-2023-36483?

CVE-2023-36483 allows remote attackers to access sensitive data including customer information and security system status.

Q: Which versions of MASmobile Classic are impacted by CVE-2023-36483?

CVE-2023-36483 impacts MASmobile Classic Android versions prior to 1.16.18 and MASmobile Classic iOS versions prior to 1.7.24.

Q: Who is at risk from CVE-2023-36483?

Users of the affected MASmobile Classic applications on both Android and iOS platforms are at risk from CVE-2023-36483 due to potential data breaches.

Published Mar 16, 2024

Updated

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and

MASmobile Classic iOS version 1.7.24 and earlier

which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.

Affected Software

5 affected components

MAS MASmobile Classic Android<1.16.18

MAS MASmobile Classic iOS<1.7.24

Honeywell Masmobile Asp.net Services<=1.9

Honeywell Masmobile Classic Iphone Os<=1.7.24

Honeywell Masmobile Classic Android<=1.16.18

Remediation

Information

1. Uninstall MASmobile Classic Services - These services are installed and configured manually in IIS within a virtual directory. To uninstall, unpublish the services in IIS and remove the service files. All versions (v1.7, 1.8, and 1.9) were discontinued. 2. Remove the MASmobile Classic app from Android and iOS devices. All versions (v1.x.x) were discontinued and no longer available in the app stores (Play and AppStore). 3. Contact MAS to arrange the installation of MASterMind EX Services (v6.46 or later). These services do not run under IIS and must be configured in coordination with the customer. 4. Install MASmobile app from Play or AppStore (v2.x.x). This is not an upgrade to MASmobile Classic; it is a different app.

Event History

Mar 16, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-36483?

The severity of CVE-2023-36483 is rated as high due to its potential for authorization bypass and data exposure.

How do I fix CVE-2023-36483?