Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2023-0011: A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the ser...
CVE-2023-0011 · published 2 years ago
Summary
A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial inter...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| u-blox | toby-l200_firmware |
All versions
cpe:2.3:o:u-blox:toby-l200_firmware:-:*:*:*:*:*:*:* |
| u-blox | toby-l201_firmware |
All versions
cpe:2.3:o:u-blox:toby-l201_firmware:-:*:*:*:*:*:*:* |
| u-blox | toby-l210_firmware |
All versions
cpe:2.3:o:u-blox:toby-l210_firmware:-:*:*:*:*:*:*:* |
| u-blox | toby-l220_firmware |
All versions
cpe:2.3:o:u-blox:toby-l220_firmware:-:*:*:*:*:*:*:* |
| u-blox | toby-l280_firmware |
All versions
cpe:2.3:o:u-blox:toby-l280_firmware:-:*:*:*:*:*:*:* |
Original advisory text
A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the ser...
A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands.
Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well..
This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.
Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well..
This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.
References
- https://www.u-blox.com/en/report-security-issues Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-20Improper Input Validation
CWE-78OS Command Injection
Timeline
Published20 Dec 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-0011 · NVD
Track software like this
Free during beta