Red TIM Research found two rare flaws in Ericsson OSS-RC component

guest · Oct 25, 2021

Red TIM Research found two rare flaws in Ericsson OSS-RC component
October 25, 2021
https://securityaffairs.co/wordpress/123764/security/ericsson-oss-rc-flaws.html

The Operations Support System – Radio and Core (OSS-RC) provides a centralized interface into the radio and core components.
The Operations Support Systems are all those systems used by companies that provide communication services for networks’ integrated function.

For example, let’s consider the case of a client that requires the activation of a new telephone line. The systems that handle these requests/CRM gather user data, but it isn’t able to configure the network to provide the service to the customer. The OSSs allow telecommunications carriers to automate this process and also to carry out management operations of the networks, such as the update of the base-band systems located on the buildings of our cities.
Click to expand...

CVE-2021-32569
In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager.

Vulnerability Description: Improper Neutralization of Input During Web Page Generation (‘Reflected Cross-site Scripting’). – CWE-79 Software Version: <=18B NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-32569 CVSv3: 6.1 Severity: Medium Credits: Alessandro Bosco, Mohamed Amine Ouad, Massimiliano Brolli

Click to expand...

CVE-2021-32571
In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undeleted but in folders accessible by top privileged accounts only.

Vulnerability Description: Incomplete Cleanup. – CWE-459 Software Version: <=18B NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-32571 CVSv3: 4.9 Severity: Medium Credits: Alessandro Bosco, Mohamed Amine Ouad, Massimiliano Brolli

Click to expand...

Log in or Sign up

Red TIM Research found two rare flaws in Ericsson OSS-RC component

guest Guest

Log in or Sign up

Red TIM Research found two rare flaws in Ericsson OSS-RC component

guest Guest

Useful Searches