CVE-2022-2483

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-1282

Affected software

Vendor	Product	Versions
Nokia	ASIK AirScale	474021A.101; 474021A.102

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02Third Party Advisory, US Government Resource

Timeline

Published: Jan 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248309.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.CVE-2022-248319.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vu CVE-2022-248326.8GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to corr CVE-2022-248336.1PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cro CVE-2022-248348.8Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the c CVE-2022-248367.5Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptibl CVE-2022-248375.3HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later hav CVE-2022-248389.8Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newl CVE-2022-248397.5org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfM CVE-2022-24847.8The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmwa CVE-2022-248409.8django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entir CVE-2022-248418.1fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by t