CVE-2022-24400
Published: 19 October 2023
Summary
CVE-2022-24400 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Midnightblue Tetra\. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29292
Vulnerability details
A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.
Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.
Prevents reliance on untrusted matching results for security-relevant decisions by enforcing verification and contest procedures.
Providing authoritative attributes with the data reduces the need for security decisions to rely on untrusted external inputs.
Reduces reliance on untrusted inputs by ensuring only authorized sources may supply data.