External risk intelligence

Turing Edge+ EVC5FD Cloud Connection Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-42425

The affected product is an edge gateway device designed for cloud connectivity. Such devices are typically deployed to bridge local security/surveillance environments with external cloud management services, making them common internet-facing appliances.

Turing Edge\+ Evc5fd Firmware

1.38.6

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in certain Turing Edge+ devices that could allow a remote attacker to execute arbitrary code and access sensitive information through their cloud connection components. This vulnerability impacts the device's ability to securely communicate with its management services, potentially exposing operational data. The primary concern at this time is to confirm whether these specific devices and configurations are present within your environment.

Unauthorized code execution and data access.
Remote exploitation risk via cloud connections.
Confirm relevance and exposure to affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to the affected device. This could allow them to execute arbitrary code on the device and gain access to sensitive information.

No special access is needed to trigger.
Cloud connection components are the trigger point.
Leads to code execution and data theft.

Live Threat

Current exploitation, exposure, and threat context

Remote attackers could execute arbitrary code and obtain sensitive information by exploiting a vulnerability in the cloud connection components of the affected device. This could lead to a compromise of the device and any data it handles when connected to the internet.

System data and sensitive information at risk.
Exploitation via cloud connection components.
Arbitrary code execution and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Turing Edge+ EVC5FD firmware enabling remote code execution and sensitive data access via cloud connections requires immediate attention. Infrastructure or platform teams managing these edge devices are likely responsible for remediation. The first practical step is to inventory all deployed instances, confirm their external reachability and business criticality, identify the accountable system owner, and then plan a risk-based remediation strategy, potentially involving vendor coordination.

Ownership: Infrastructure or platform teams.
Verify first: Device external exposure and criticality.
Action: Plan and coordinate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Turing Edge+ EVC5FD device?

The Turing Edge+ EVC5FD is an edge gateway appliance designed to bridge local security and surveillance systems with cloud management platforms. It acts as a bridge that enables remote monitoring and control, making these devices essential for centralized infrastructure management in security-sensitive environments.

What does CWE-295 mean for CVE-2023-42425?

CWE-295 refers to Improper Certificate Validation. In the context of this vulnerability, it means the device fails to properly verify the authenticity of secure connections. Because of this weakness, the system may accept fraudulent or malicious communication channels, allowing an attacker to intercept or manipulate data intended for the cloud.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending specially crafted network data to the device's cloud connection components. This does not require the attacker to have prior authentication or special physical access. Simply interacting with these specific cloud-facing services is sufficient to initiate the attack; legitimate management traffic alone does not trigger the flaw.

Do I need to worry if my device is internal?

Halo Surface Signal notes that these gateways are built for cloud connectivity, frequently making them internet-facing. If your device is exposed directly to the internet, your risk is significantly higher. Even for internal-only devices, you should assess whether they bridge to cloud services that could be targeted by an attacker who has already breached your perimeter.

What should I do first to manage this risk?

Start by conducting a thorough inventory to locate all Turing Edge+ EVC5FD units in your environment. Once identified, verify their network placement and determine which teams own or manage them. Do not rely on assumptions about their connectivity; confirm their actual external reachability to prioritize which devices require immediate protective measures or vendor-provided updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.