Calix GigaCenter ONT UART Physical Access Root Privilege Escalation (CVE-2023-52914)

Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Excessive Privileges in GigaCenter ONT allows unauthorized access to UART Code Name: azalea Status: Public Release Date: Sep 8, 2023 Affected Product: Calix GigaCenter ONT (Broadcom SoC) Vendor: Calix Affected Versions: 844E, 8445E, 8445E-S, 845E, S120, S130, and S160 Fixed Version: H12.7.3.x patch release is in crowdsource phase Vulnerability ID Name: Excessive Privileges Vulnerability Type: TSM: excessive-privileges Remotely Exploitable: No CVSS v3.0 Vector String: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C/CR:H/IR:H/AR:H CVSS v3.0 Base Score: 7.0 CVE Availability: Yes CVE ID: CVE-2023-52914 Description Affected Devices: Calix GigaCenter ONT models 844E, 8445E, 8445E-S, 845E, S12市, S130, and S160 contain a vulnerability that allows access to the ONT via UART connected to the ONT debug interface. Risk: Attackers can gain full control over the system, including but not limited to: user accounts, personally identifiable information, configuration files, logs, network traffic, stored data, encryption keys, SSH keys, certificates, and firmware. Vulnerability Details UART Interface Location: - Broadcom SoC UART is located at the PCB edge. - Qualcomm SoC UART is located between the SoC and serial flash memory. Exploitation Method Steps: - Connect a UART USB adapter to the Broadcom SoC UART interface and directly obtain a root shell. Evidence Images and video evidence of the exploitation process are provided. Mitigation The vulnerability has been disclosed to Calix, and appropriate security measures are recommended to prevent unauthorized access. Timeline Record of key milestones from vulnerability discovery to public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Calix GigaCenter ONT UART Physical Access Root Privilege Escalation (CVE-2023-52914)