Login Request a demo
High severity · published Jan 25, 2024
CVE-2024-23630
Motorola MR2600 Arbitrary Firmware Upload Vulnerability
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device. Authentication is required, however can be bypassed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
MR2600 · Motorola
1.0.7 · source: vendor
MF
Mr2600 Firmware · Motorola
All versions, or not specified · source: NVD
Affected product
MR
MR2600
Motorola
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23630
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23630
Third Party Advisory
https://blog.exodusintel.com/2024/01/25/motorola-mr2600-arbitrary-firmware-upload-vulnerability/
More from MR2600
8.8
CVE-2024-23628
Motorola MR2600 SaveStaticRouteIPv6Params Command Injection Vulnerability
8.8
CVE-2024-23627
Motorola MR2600 SaveStaticRouteIPv4Params Command Injection Vulnerability
8.8
CVE-2024-23626
Motorola MR2600 SaveSysLogParams Command Injection Vulnerability
7.5
CVE-2024-23629
Motorola MR2600 Authentication Bypass Vulnerability
6.5
CVE-2022-3681
A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully brute force the WPS…