Critical vulnerabilities detected in Atos Unify suite
Take action: Lock down your Atos Unify management interfaces (both SSH and Web) to be accessible only in internal secured networks - never exposed on the internet. And plan for a patch, since even the locked down access can still be reached by other malware.
Learn More
Cybersecurity researchers at SEC Consult have identified two vulnerabilities in Atos Unify products. These vulnerabilities pose significant risks, potentially enabling malicious actors to disrupt operations and compromise the targeted system.
The identified weaknesses are present in the unified communications and collaboration solution provided by Atos Unify. Specifically, they affect
- Atos Unify Session Border Controller (SBC), which ensures security for unified communications,
- Unify OpenScape Branch product catering to remote offices,
- Border Control Function (BCF), primarily designed for emergency services.
One of the vulnerabilities, tracked as CVE-2023-36618, impacts the web interface of these products. It allows an attacker with authenticated but low privileges to exploit the system, executing arbitrary PHP functions and subsequently operating system commands with root privileges.
The second vulnerability, tracked as CVE-2023-36619, is exploitable by an unauthenticated attacker. This vulnerability permits unauthorized access and execution of certain scripts. Attackers could leverage these scripts to induce a denial-of-service (DoS) condition or modify the system's configuration.
Atos, has classified these vulnerabilities as 'high severity' based on the Common Vulnerability Scoring System (CVSS) score. If an attacker possesses low-privileged user credentials, they could achieve full control (root access) over the appliance. This level of control enables them to reconfigure or backdoor the system, such as altering SIP upstream configurations.
The affected web interface is typically not exposed to the internet, and analysis indicates that there are no accessible systems via the web, as per Shodan data. Also, there is no proof-of-concept (PoC) exploit code.
- Disable low-privileged accounts (e.g guest account) or disable ssh access for the accounts
- Make sure root account is not accessible via ssh
- Restrict external ssh access to a single account
- Do not publicly expose the admin interface of the affected systems
