CVE-2023-39222

Published: Oct 3, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.

Affected (14)

Products: Furunosystems: Acera 1310 Firmware, Acera 1320 Firmware, Acera 1210 Firmware, Acera 1150i Firmware, Acera 1150w Firmware, Acera 1110 Firmware, Acera 1020 Firmware, Acera 1010 Firmware, Acera 950 Firmware, Acera 850f Firmware, Acera 900 Firmware, Acera 850m Firmware, Acera 810 Firmware, Acera 800st Firmware

14 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1310 Firmware	Up to 01.26

Running on/with	Platform Versions
Furunosystems Acera 1310	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1320 Firmware	Up to 01.26

Running on/with	Platform Versions
Furunosystems Acera 1320	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1210 Firmware	Up to 02.36

Running on/with	Platform Versions
Furunosystems Acera 1210	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1150i Firmware	Up to 01.35

Running on/with	Platform Versions
Furunosystems Acera 1150i	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1150w Firmware	Up to 01.35

Running on/with	Platform Versions
Furunosystems Acera 1150w	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1110 Firmware	Up to 01.76

Running on/with	Platform Versions
Furunosystems Acera 1110	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1020 Firmware	Up to 01.86

Running on/with	Platform Versions
Furunosystems Acera 1020	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 1010 Firmware	Up to 01.86

Running on/with	Platform Versions
Furunosystems Acera 1010	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 950 Firmware	Up to 01.60

Running on/with	Platform Versions
Furunosystems Acera 950	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 850f Firmware	Up to 01.60

Running on/with	Platform Versions
Furunosystems Acera 850f	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 900 Firmware	Up to 02.54

Running on/with	Platform Versions
Furunosystems Acera 900	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 850m Firmware	Up to 02.06

Running on/with	Platform Versions
Furunosystems Acera 850m	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 810 Firmware	Up to 03.74

Running on/with	Platform Versions
Furunosystems Acera 810	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furunosystems Acera 800st Firmware	Up to 07.35

Running on/with	Platform Versions
Furunosystems Acera 800st	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

https://jvn.jp/en/vu/JVNVU94497038/

Source: vultures@jpcert.or.jp

Third Party Advisory

https://www.furunosystems.co.jp/news/info/vulner20231002.html

Source: vultures@jpcert.or.jp

Vendor Advisory

https://jvn.jp/en/vu/JVNVU94497038/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.furunosystems.co.jp/news/info/vulner20231002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.