CVE-2023-39222
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.29% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- furunosystems/acera 1310 firmware · furunosystems/acera 1320 firmware · furunosystems/acera 1210 firmware · furunosystems/acera 1150i firmware · furunosystems/acera 1150w firmware · furunosystems/acera 1110 firmware · furunosystems/acera 1020 firmware · furunosystems/acera 1010 firmware · furunosystems/acera 950 firmware · furunosystems/acera 850f firmware · furunosystems/acera 900 firmware · furunosystems/acera 850m firmware · furunosystems/acera 810 firmware · furunosystems/acera 800st firmware
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/vu/JVNVU94497038/Third Party Advisory
- https://www.furunosystems.co.jp/news/info/vulner20231002.htmlVendor Advisory
- https://jvn.jp/en/vu/JVNVU94497038/Third Party Advisory
- https://www.furunosystems.co.jp/news/info/vulner20231002.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.