SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-38555

Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products.

HIGH 8.8EPSS 0.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 90brin all versions, Si-R570B all versions, Si-R370B all versions, Si-R220D all versions, Si-R G100 V02.54 and earlier, Si-R G200 V02.54 and earlier, Si-R G100B V04.12 and earlier, Si-R G110B V04.12 and earlier, Si-R G200B V04.12 and earlier, Si-R G210 V20.52 and earlier, Si-R G211 V20.52 and earlier, Si-R G120 V20.52 and earlier, Si-R G121 V20.52 and earlier, and SR-M 50AP1 all versions.

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.37% probability · 31th percentile
CISA KEV
Not listed
Weakness
CWE-287
Affected
fujitsu/si-r 30b firmware · fujitsu/si-r 130b firmware · fujitsu/si-r 90brin firmware · fujitsu/si-r570b firmware · fujitsu/si-r370b firmware · fujitsu/si-r220d firmware · fujitsu/si-r g100 firmware · fujitsu/si-r g200 firmware · fujitsu/si-r g100b firmware · fujitsu/si-r g110b firmware · fujitsu/si-r g200b firmware · fujitsu/si-r g210 firmware · fujitsu/si-r g211 firmware · fujitsu/si-r g120 firmware · fujitsu/si-r g121 firmware · fujitsu/sr-m 50ap1 firmware
Source
vultures@jpcert.or.jp

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.