CVE-2023-23294

high-risk
Published 2023-02-23

Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.

Do I need to act?

~
2.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (15)

Jetwave 2212G Firmware
Jetwave 2212X Firmware
Jetwave 2212S Firmware
Jetwave 2211C Firmware
Jetwave 2411 Firmware
Jetwave 2111 Firmware
Jetwave 2411L Firmware
Jetwave 2111L Firmware
Jetwave 2414 Firmware
Jetwave 2114 Firmware
Jetwave 2424 Firmware
Jetwave 2460 Firmware
Jetwave 4221Hp-E Firmware
Jetwave 3220 V3 Firmware
Jetwave 3420 V3 Firmware

Affected Vendors

Korenix

References (2)

Exploit https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series...
Exploit https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series...
54
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 6/34 · Minimal
Exposure 18/34 · Moderate