1. Home
  2. CVE Database
  3. CVE-2022-26942
HIGH · 8.2

CVE-2022-26942

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the o...

Vulnerability Description

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.

CVSS Score

8.2

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
MotorolaMtm5500 Firmware-
MotorolaMtm5500-
MotorolaMtm5400 Firmware-
MotorolaMtm5400-

Related Weaknesses (CWE)

CWE-763CWE-822

References

FAQ

What is CVE-2022-26942?

CVE-2022-26942 is a vulnerability with a CVSS score of 8.2 (HIGH). The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the o...

How severe is CVE-2022-26942?

CVE-2022-26942 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-26942?

Check the references section above for vendor advisories and patch information. Affected products include: Motorola Mtm5500 Firmware, Motorola Mtm5500, Motorola Mtm5400 Firmware, Motorola Mtm5400.