CVE-2023-23294

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

2.69%

Published

Feb 23, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77

Affected Products (30)

korenix · jetwave_2212g_firmwarevulnerable

korenix · jetwave_2212g

korenix · jetwave_2212x_firmwarevulnerable

korenix · jetwave_2212x

korenix · jetwave_2212s_firmwarevulnerable

korenix · jetwave_2212s

korenix · jetwave_2211c_firmware (up to 1.6)vulnerable

korenix · jetwave_2211c

korenix · jetwave_2411_firmware (up to 1.5)vulnerable

korenix · jetwave_2411

korenix · jetwave_2111_firmware (up to 1.5)vulnerable

korenix · jetwave_2111

korenix · jetwave_2411l_firmware (up to 1.6)vulnerable

korenix · jetwave_2411l

korenix · jetwave_2111l_firmware (up to 1.6)vulnerable

korenix · jetwave_2111l

korenix · jetwave_2414_firmware (up to 1.4)vulnerable

korenix · jetwave_2414

korenix · jetwave_2114_firmware (up to 1.4)vulnerable

korenix · jetwave_2114

korenix · jetwave_2424_firmware (up to 1.3)vulnerable

korenix · jetwave_2414

korenix · jetwave_2460_firmware (up to 1.6)vulnerable

korenix · jetwave_2460

korenix · jetwave_4221hp-e__firmwarevulnerable

korenix · jetwave_4221hp-e

korenix · jetwave_3220_v3__firmware (up to 1.7)vulnerable

korenix · jetwave_3220_v3

korenix · jetwave_3420_v3__firmware (up to 1.7)vulnerable

korenix · jetwave_3420_v3

References (2)

https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/

ExploitThird Party Advisory

https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs