A researcher has discovered a critical vulnerability in Baicells Technologies' wireless communication base stations that can be exploited to cause disruption in telecom networks or take complete control of data and voice traffic. Baicells Technologies is a US-based telecommunications equipment provider for 4G and 5G networks, with over 100,000 of its base stations deployed across 64 countries. The vulnerability, tracked as CVE-2023-24508, is a command injection vulnerability that can be exploited remotely without authentication by sending specially crafted HTTP requests to the targeted device. If exploited, an attacker can run shell commands with root privileges and take complete control of the device, shutting it down to cause disruption or obtaining information such as phone numbers, IMEI, and location data. According to the researcher, there are more than 1,150 devices exposed to the internet, mostly located in the United States. Baicells released a patch for the vulnerability on January 24, which affects Nova 227, 233, 243 and 246 base stations. The US Cybersecurity and Infrastructure Security Agency also released an advisory about the vulnerability. The researcher also recently discovered serious vulnerabilities in Econolite EOS traffic controller software, which can be exploited to control traffic lights.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 06 Feb 2023 18:42:02 +0000