Search criteria

6 vulnerabilities by FURUNO SYSTEMS Co.,Ltd.

CVE-2024-28744 (GCVE-0-2024-28744)

Vulnerability from cvelistv5 – Published: 2024-04-08 00:16 – Updated: 2024-08-02 00:56
VLAI?
Summary
The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.
Severity ?
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • Empty Password in Configuration File
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 9010-08 Affected: firmware v02.04 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_9010-08_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_9010-08_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "02.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_9010-24_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_9010-24_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "02.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-28744",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-31T18:13:16.617613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-258",
                "description": "CWE-258 Empty Password in Configuration File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T18:16:55.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:56:58.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU99285099/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 9010-08",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware v02.04 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 9010-24",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware v02.04 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Empty Password in Configuration File",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-08T00:16:21.116Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU99285099/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-28744",
    "datePublished": "2024-04-08T00:16:21.116Z",
    "dateReserved": "2024-03-08T05:25:54.146Z",
    "dateUpdated": "2024-08-02T00:56:58.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-43627 (GCVE-0-2023-43627)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:18 – Updated: 2024-09-20 15:10
VLAI?
Summary
Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
Severity ?
No CVSS data available.
CWE
  • Path traversal
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 1320 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1310 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T15:08:52.656163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T15:10:16.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:18:13.113Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43627",
    "datePublished": "2023-10-03T00:18:13.113Z",
    "dateReserved": "2023-09-22T04:36:31.640Z",
    "dateUpdated": "2024-09-20T15:10:16.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-42771 (GCVE-0-2023-42771)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:17 – Updated: 2024-09-20 13:36
VLAI?
Summary
Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.
Severity ?
8.3 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE
  • Authentication bypass
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 1320 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1310 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:30:24.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_1320_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "01.26",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_1310_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "01.26",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-42771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T13:36:23.487612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T13:36:28.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:17:00.358Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42771",
    "datePublished": "2023-10-03T00:17:00.358Z",
    "dateReserved": "2023-09-22T04:36:33.436Z",
    "dateUpdated": "2024-09-20T13:36:28.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-41086 (GCVE-0-2023-41086)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:15 – Updated: 2024-08-02 18:46
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity ?
No CVSS data available.
CWE
  • Cross-site request forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 1210 Affected: firmware ver.02.36 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:46:11.906Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1210",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.36 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150i",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150w",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1110",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.76 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1020",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1010",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 950",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850F",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 900",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.54 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850M",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.06 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 810",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.03.74 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 800ST",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.07.35 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:15:47.652Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-41086",
    "datePublished": "2023-10-03T00:15:47.652Z",
    "dateReserved": "2023-09-22T04:36:30.685Z",
    "dateUpdated": "2024-08-02T18:46:11.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39429 (GCVE-0-2023-39429)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:14 – Updated: 2024-09-20 18:32
VLAI?
Summary
Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting (XSS)
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 1210 Affected: firmware ver.02.36 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:20.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T18:32:31.947234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T18:32:39.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1210",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.36 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150i",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150w",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1110",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.76 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1020",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1010",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 950",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850F",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 900",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.54 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850M",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.06 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 810",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.03.74 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 800ST",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.07.35 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:14:18.187Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-39429",
    "datePublished": "2023-10-03T00:14:18.187Z",
    "dateReserved": "2023-09-22T04:36:32.490Z",
    "dateUpdated": "2024-09-20T18:32:39.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39222 (GCVE-0-2023-39222)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:12 – Updated: 2024-09-20 18:33
VLAI?
Summary
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity ?
No CVSS data available.
CWE
  • OS command injection
Assigner
References
Impacted products
Vendor Product Version
FURUNO SYSTEMS Co.,Ltd. ACERA 1320 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1310 Affected: firmware ver.01.26 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1210 Affected: firmware ver.02.36 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1150i Affected: firmware ver.01.35 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1150w Affected: firmware ver.01.35 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1110 Affected: firmware ver.01.76 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1020 Affected: firmware ver.01.86 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 1010 Affected: firmware ver.01.86 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 950 Affected: firmware ver.01.60 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 850F Affected: firmware ver.01.60 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 900 Affected: firmware ver.02.54 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 850M Affected: firmware ver.02.06 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 810 Affected: firmware ver.03.74 and earlier
Create a notification for this product.
    FURUNO SYSTEMS Co.,Ltd. ACERA 800ST Affected: firmware ver.07.35 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T18:33:09.595611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T18:33:35.622Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1210",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.36 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150i",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1150w",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.35 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1110",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.76 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1020",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1010",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.86 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 950",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850F",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.60 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 900",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.54 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 850M",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.02.06 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 810",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.03.74 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 800ST",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.07.35 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS command injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:12:04.706Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-39222",
    "datePublished": "2023-10-03T00:12:04.706Z",
    "dateReserved": "2023-09-22T04:36:29.779Z",
    "dateUpdated": "2024-09-20T18:33:35.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}