CVE-2023-23295
High
Description
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
SeverityHigh
CVSS8.8
Exploit probability—
ProductKorenix Jetwave 2212g Firmware
PublishedFeb 23, 2023
First seenFeb 23, 2023
Weakness typeCWE-77Command injection
How to fix
Update
- korenix jetwave_2211c_firmware1.6 or later
- korenix jetwave_2411_firmware1.5 or later
- korenix jetwave_2111_firmware1.5 or later
- korenix jetwave_2411l_firmware1.6 or later
- korenix jetwave_2111l_firmware1.6 or later
- korenix jetwave_2414_firmware1.4 or later
- korenix jetwave_2114_firmware1.4 or later
- korenix jetwave_2424_firmware1.3 or later
- korenix jetwave_2460_firmware1.6 or later
- korenix jetwave_3220_v3__firmware1.7 or later
- korenix jetwave_3420_v3__firmware1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| korenix jetwave_2212g_firmware | 1.3.t | — |
| korenix jetwave_2212x_firmware | 1.3.0 | — |
| korenix jetwave_2212s_firmware | 1.3.0 | — |
| korenix jetwave_2211c_firmware | v < 1.6 | 1.6 |
| korenix jetwave_2411_firmware | v < 1.5 | 1.5 |
| korenix jetwave_2111_firmware | v < 1.5 | 1.5 |
| korenix jetwave_2411l_firmware | v < 1.6 | 1.6 |
| korenix jetwave_2111l_firmware | v < 1.6 | 1.6 |
| korenix jetwave_2414_firmware | v < 1.4 | 1.4 |
| korenix jetwave_2114_firmware | v < 1.4 | 1.4 |
| korenix jetwave_2424_firmware | v < 1.3 | 1.3 |
| korenix jetwave_2460_firmware | v < 1.6 | 1.6 |
| korenix jetwave_4221hp-e__firmware | v ≤ 1.3.0 | — |
| korenix jetwave_3220_v3__firmware | v < 1.7 | 1.7 |
| korenix jetwave_3420_v3__firmware | v < 1.7 | 1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.