CVE-2023-41086
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- furunosystems/acera 1210 firmware · furunosystems/acera 1150i firmware · furunosystems/acera 1150w firmware · furunosystems/acera 1110 firmware · furunosystems/acera 1020 firmware · furunosystems/acera 1010 firmware · furunosystems/acera 950 firmware · furunosystems/acera 850f firmware · furunosystems/acera 900 firmware · furunosystems/acera 850m firmware · furunosystems/acera 810 firmware · furunosystems/acera 800st firmware
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/vu/JVNVU94497038/Third Party Advisory
- https://www.furunosystems.co.jp/news/info/vulner20231002.htmlVendor Advisory
- https://jvn.jp/en/vu/JVNVU94497038/Third Party Advisory
- https://www.furunosystems.co.jp/news/info/vulner20231002.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.