Vulnerability in Csl Dualcom Gprs

CVE-2015-7286

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.

Affected products

Csl_dualcom Gprs — versions cs2300-r
Csl_dualcom Gprs_cs2300-r_firmware — versions 1.25, 3.53
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
cret@cert.org (Exploit, x_refsource_MISC)
cret@cert.org (x_refsource_CONFIRM, US Government Resource, Third Party Advisory)