CVE-2023-6729: Nokia SR OS: File Access Security Vulnerability
Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well as other files stored in the Compact Flash or SD card without using CLI commands. This type of attack can lead to a compromise or denial of service of the router after the system is rebooted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6729?
CVE-2023-6729 is considered a high-risk vulnerability due to its potential for unauthorized read-write access to critical system files.
How do I fix CVE-2023-6729?
To mitigate CVE-2023-6729, restrict user permissions and ensure that only trusted users have access to the console.
Who is affected by CVE-2023-6729?
CVE-2023-6729 affects users of Nokia SR OS routers configured with the 'access console' permission.
What type of access does CVE-2023-6729 provide to attackers?
CVE-2023-6729 allows low privilege authenticated users to read or modify the entire file system, including crucial configuration files.
Is there a patch available for CVE-2023-6729?
As of now, the status of a patch for CVE-2023-6729 should be confirmed through Nokia's official security channels.