Vulnerability · Published Mar 16, 2024 · Assigned by Carrier
CVE-2023-36483MAS (a Carrier brand) MASmobile Classic Authorization Bypass
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in MAS ASP.Net Services from MAS (a Carrier brand). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MAS (a Carrier brand) | MASmobile Classic | 1 – through 1.16.18 |
| MAS (a Carrier brand) | MASmobile Classic | 1 – through 1.7.24 |
| MAS (a Carrier brand) | MAS ASP.Net Services | 1 – through 1.9 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N