Search
Find a vulnerability
Search criteria
14 vulnerabilities by FURUNO SYSTEMS Co.,Ltd.
CVE-2024-28744 (GCVE-0-2024-28744)
Vulnerability from nvd – Published: 2024-04-08 00:16 – Updated: 2024-08-02 00:56
VLAI
Summary
The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Empty Password in Configuration File
- CWE-258 - Empty Password in Configuration File
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 9010-08 |
Affected:
firmware v02.04 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 9010-24 |
Affected:
firmware v02.04 and earlier
|
|
| furunosystems | acera_9010-08_firmware |
Affected:
0 , ≤ 02.04
(custom)
cpe:2.3:o:furunosystems:acera_9010-08_firmware:*:*:*:*:*:*:*:* |
|
| furunosystems | acera_9010-24_firmware |
Affected:
0 , ≤ 02.04
(custom)
cpe:2.3:o:furunosystems:acera_9010-24_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_9010-08_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_9010-08_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "02.04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_9010-24_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_9010-24_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "02.04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28744",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T18:13:16.617613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-258",
"description": "CWE-258 Empty Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T18:16:55.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:56:58.148Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU99285099/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ACERA 9010-08",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware v02.04 and earlier"
}
]
},
{
"product": "ACERA 9010-24",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware v02.04 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Empty Password in Configuration File",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-08T00:16:21.116Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU99285099/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28744",
"datePublished": "2024-04-08T00:16:21.116Z",
"dateReserved": "2024-03-08T05:25:54.146Z",
"dateUpdated": "2024-08-02T00:56:58.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43627 (GCVE-0-2023-43627)
Vulnerability from nvd – Published: 2023-10-03 00:18 – Updated: 2024-09-20 15:10
VLAI
Summary
Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Path traversal
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:44:43.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T15:08:52.656163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T15:10:16.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path traversal",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:18:13.113Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-43627",
"datePublished": "2023-10-03T00:18:13.113Z",
"dateReserved": "2023-09-22T04:36:31.640Z",
"dateUpdated": "2024-09-20T15:10:16.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42771 (GCVE-0-2023-42771)
Vulnerability from nvd – Published: 2023-10-03 00:17 – Updated: 2024-09-20 13:36
VLAI
Summary
Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Authentication bypass
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
|
| furunosystems | acera_1320_firmware |
Affected:
0 , ≤ 01.26
(custom)
cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:* |
|
| furunosystems | acera_1310_firmware |
Affected:
0 , ≤ 01.26
(custom)
cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:30:24.335Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_1320_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "01.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_1310_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "01.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-42771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T13:36:23.487612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T13:36:28.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Authentication bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:17:00.358Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-42771",
"datePublished": "2023-10-03T00:17:00.358Z",
"dateReserved": "2023-09-22T04:36:33.436Z",
"dateUpdated": "2024-09-20T13:36:28.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41086 (GCVE-0-2023-41086)
Vulnerability from nvd – Published: 2023-10-03 00:15 – Updated: 2024-08-02 18:46
VLAI
Summary
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
CWE
- Cross-site request forgery (CSRF)
Assigner
References
2 references
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:46:11.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site request forgery (CSRF)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:15:47.652Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41086",
"datePublished": "2023-10-03T00:15:47.652Z",
"dateReserved": "2023-09-22T04:36:30.685Z",
"dateUpdated": "2024-08-02T18:46:11.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39429 (GCVE-0-2023-39429)
Vulnerability from nvd – Published: 2023-10-03 00:14 – Updated: 2024-09-20 18:32
VLAI
Summary
Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:10:20.898Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T18:32:31.947234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:32:39.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:14:18.187Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39429",
"datePublished": "2023-10-03T00:14:18.187Z",
"dateReserved": "2023-09-22T04:36:32.490Z",
"dateUpdated": "2024-09-20T18:32:39.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39222 (GCVE-0-2023-39222)
Vulnerability from nvd – Published: 2023-10-03 00:12 – Updated: 2024-09-20 18:33
VLAI
Summary
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS command injection
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.297Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T18:33:09.595611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:33:35.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:12:04.706Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39222",
"datePublished": "2023-10-03T00:12:04.706Z",
"dateReserved": "2023-09-22T04:36:29.779Z",
"dateUpdated": "2024-09-20T18:33:35.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28744 (GCVE-0-2024-28744)
Vulnerability from cvelistv5 – Published: 2024-04-08 00:16 – Updated: 2024-08-02 00:56
VLAI
Summary
The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Empty Password in Configuration File
- CWE-258 - Empty Password in Configuration File
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 9010-08 |
Affected:
firmware v02.04 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 9010-24 |
Affected:
firmware v02.04 and earlier
|
|
| furunosystems | acera_9010-08_firmware |
Affected:
0 , ≤ 02.04
(custom)
cpe:2.3:o:furunosystems:acera_9010-08_firmware:*:*:*:*:*:*:*:* |
|
| furunosystems | acera_9010-24_firmware |
Affected:
0 , ≤ 02.04
(custom)
cpe:2.3:o:furunosystems:acera_9010-24_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_9010-08_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_9010-08_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "02.04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_9010-24_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_9010-24_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "02.04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28744",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T18:13:16.617613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-258",
"description": "CWE-258 Empty Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T18:16:55.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:56:58.148Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU99285099/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ACERA 9010-08",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware v02.04 and earlier"
}
]
},
{
"product": "ACERA 9010-24",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware v02.04 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Empty Password in Configuration File",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-08T00:16:21.116Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU99285099/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28744",
"datePublished": "2024-04-08T00:16:21.116Z",
"dateReserved": "2024-03-08T05:25:54.146Z",
"dateUpdated": "2024-08-02T00:56:58.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43627 (GCVE-0-2023-43627)
Vulnerability from cvelistv5 – Published: 2023-10-03 00:18 – Updated: 2024-09-20 15:10
VLAI
Summary
Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Path traversal
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:44:43.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T15:08:52.656163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T15:10:16.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path traversal",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:18:13.113Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-43627",
"datePublished": "2023-10-03T00:18:13.113Z",
"dateReserved": "2023-09-22T04:36:31.640Z",
"dateUpdated": "2024-09-20T15:10:16.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42771 (GCVE-0-2023-42771)
Vulnerability from cvelistv5 – Published: 2023-10-03 00:17 – Updated: 2024-09-20 13:36
VLAI
Summary
Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Authentication bypass
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
|
| furunosystems | acera_1320_firmware |
Affected:
0 , ≤ 01.26
(custom)
cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:* |
|
| furunosystems | acera_1310_firmware |
Affected:
0 , ≤ 01.26
(custom)
cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:30:24.335Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_1320_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "01.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "acera_1310_firmware",
"vendor": "furunosystems",
"versions": [
{
"lessThanOrEqual": "01.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-42771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T13:36:23.487612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T13:36:28.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Authentication bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:17:00.358Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-42771",
"datePublished": "2023-10-03T00:17:00.358Z",
"dateReserved": "2023-09-22T04:36:33.436Z",
"dateUpdated": "2024-09-20T13:36:28.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41086 (GCVE-0-2023-41086)
Vulnerability from cvelistv5 – Published: 2023-10-03 00:15 – Updated: 2024-08-02 18:46
VLAI
Summary
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
CWE
- Cross-site request forgery (CSRF)
Assigner
References
2 references
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:46:11.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site request forgery (CSRF)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:15:47.652Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41086",
"datePublished": "2023-10-03T00:15:47.652Z",
"dateReserved": "2023-09-22T04:36:30.685Z",
"dateUpdated": "2024-08-02T18:46:11.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39429 (GCVE-0-2023-39429)
Vulnerability from cvelistv5 – Published: 2023-10-03 00:14 – Updated: 2024-09-20 18:32
VLAI
Summary
Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:10:20.898Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T18:32:31.947234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:32:39.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:14:18.187Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39429",
"datePublished": "2023-10-03T00:14:18.187Z",
"dateReserved": "2023-09-22T04:36:32.490Z",
"dateUpdated": "2024-09-20T18:32:39.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39222 (GCVE-0-2023-39222)
Vulnerability from cvelistv5 – Published: 2023-10-03 00:12 – Updated: 2024-09-20 18:33
VLAI
Summary
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS command injection
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1320 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1310 |
Affected:
firmware ver.01.26 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1210 |
Affected:
firmware ver.02.36 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150i |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1150w |
Affected:
firmware ver.01.35 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1110 |
Affected:
firmware ver.01.76 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1020 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 1010 |
Affected:
firmware ver.01.86 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 950 |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850F |
Affected:
firmware ver.01.60 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 900 |
Affected:
firmware ver.02.54 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 850M |
Affected:
firmware ver.02.06 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 810 |
Affected:
firmware ver.03.74 and earlier
|
|
| FURUNO SYSTEMS Co.,Ltd. | ACERA 800ST |
Affected:
firmware ver.07.35 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.297Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T18:33:09.595611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:33:35.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ACERA 1320",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1310",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.26 and earlier"
}
]
},
{
"product": "ACERA 1210",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.36 and earlier"
}
]
},
{
"product": "ACERA 1150i",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1150w",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.35 and earlier"
}
]
},
{
"product": "ACERA 1110",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.76 and earlier"
}
]
},
{
"product": "ACERA 1020",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 1010",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.86 and earlier"
}
]
},
{
"product": "ACERA 950",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 850F",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.01.60 and earlier"
}
]
},
{
"product": "ACERA 900",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.54 and earlier"
}
]
},
{
"product": "ACERA 850M",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.02.06 and earlier"
}
]
},
{
"product": "ACERA 810",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.03.74 and earlier"
}
]
},
{
"product": "ACERA 800ST",
"vendor": "FURUNO SYSTEMS Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware ver.07.35 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-03T00:12:04.706Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU94497038/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39222",
"datePublished": "2023-10-03T00:12:04.706Z",
"dateReserved": "2023-09-22T04:36:29.779Z",
"dateUpdated": "2024-09-20T18:33:35.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2024-003051
Vulnerability from jvndb - Published: 2024-04-02 18:03 - Updated:2024-04-02 18:03
Severity
Summary
FURUNO SYSTEMS Managed Switch ACERA 9010 running in non MS mode with the initial configuration has no password
Details
In the initial configuration of Managed Switch ACERA 9010 provided by FURUNO Systems Co., Ltd., the password is empty (CWE-258) and the remote access service is enabled.
The products are affected only when running in non MS mode with the initial configuration.
FURUNO SYSTEMS Co.,Ltd. reported this vulnerability to JPCERT/CC to notify users of the solutions through JVN.
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003051.html",
"dc:date": "2024-04-02T18:03+09:00",
"dcterms:issued": "2024-04-02T18:03+09:00",
"dcterms:modified": "2024-04-02T18:03+09:00",
"description": "In the initial configuration of Managed Switch ACERA 9010 provided by FURUNO Systems Co., Ltd., the password is empty (CWE-258) and the remote access service is enabled.\r\n\r\nThe products are affected only when running in non MS mode with the initial configuration.\r\n\r\nFURUNO SYSTEMS Co.,Ltd. reported this vulnerability to JPCERT/CC to notify users of the solutions through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003051.html",
"sec:cpe": [
{
"#text": "cpe:/o:furunosystems:furuno_systems_acera_9010-08",
"@product": "ACERA 9010-08",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:furuno_systems_acera_9010-24",
"@product": "ACERA 9010-24",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "8.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-003051",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU99285099/index.html",
"@id": "JVNVU#99285099",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-28744",
"@id": "CVE-2024-28744",
"@source": "CVE"
},
{
"#text": "https://cwe.mitre.org/data/definitions/258.html",
"@id": "CWE-258",
"@title": "Empty Password in Configuration File(CWE-258)"
}
],
"title": "FURUNO SYSTEMS Managed Switch ACERA 9010 running in non MS mode with the initial configuration has no password"
}
JVNDB-2023-003767
Vulnerability from jvndb - Published: 2023-10-03 14:26 - Updated:2024-05-22 18:01
Severity
Summary
Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode
Details
Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below.
* OS Command Injection (CWE-78) - CVE-2023-39222
* Cross-site Scripting (CWE-79) - CVE-2023-39429
* Cross-Site Request Forgery (CWE-352) - CVE-2023-41086
* Authentication Bypass (CWE-288) - CVE-2023-42771
* Path traversal (CWE-22) - CVE-2023-43627
Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC.
JPCERT/CC coordinated with the developer.
As a result of the developer's investigation into this report, other vulnerabilities were newly discovered and addressed.
The developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.
References
Impacted products
| Vendor | Product | |||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
"dc:date": "2024-05-22T18:01+09:00",
"dcterms:issued": "2023-10-03T14:26+09:00",
"dcterms:modified": "2024-05-22T18:01+09:00",
"description": "Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below.\r\n\r\n* OS Command Injection (CWE-78) - CVE-2023-39222\r\n* Cross-site Scripting (CWE-79) - CVE-2023-39429\r\n* Cross-Site Request Forgery (CWE-352) - CVE-2023-41086\r\n* Authentication Bypass (CWE-288) - CVE-2023-42771\r\n* Path traversal (CWE-22) - CVE-2023-43627\r\n\r\nKatsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.\r\n\r\nAs a result of the developer\u0027s investigation into this report, other vulnerabilities were newly discovered and addressed.\r\nThe developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.",
"link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
"sec:cpe": [
{
"#text": "cpe:/o:furunosystems:acera_1010_firmware",
"@product": "ACERA 1010 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1020_firmware",
"@product": "ACERA 1020 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1110_firmware",
"@product": "ACERA 1110 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1150i_firmware",
"@product": "ACERA 1150i firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1150w_firmware",
"@product": "ACERA 1150w firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1210_firmware",
"@product": "ACERA 1210 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1310_firmware",
"@product": "ACERA 1310 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_1320_firmware",
"@product": "ACERA 1320 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_800st_firmware",
"@product": "ACERA 800ST firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_810_firmware",
"@product": "ACERA 810 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_850f_firmware",
"@product": "ACERA 850F firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_850m_firmware",
"@product": "ACERA 850M firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_900_firmware",
"@product": "ACERA 900 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
},
{
"#text": "cpe:/o:furunosystems:acera_950_firmware",
"@product": "ACERA 950 firmware",
"@vendor": "FURUNO SYSTEMS Co.,Ltd.",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "8.3",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2023-003767",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU94497038/index.html",
"@id": "JVNVU#94497038",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-39222",
"@id": "CVE-2023-39222",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-39429",
"@id": "CVE-2023-39429",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-41086",
"@id": "CVE-2023-41086",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-42771",
"@id": "CVE-2023-42771",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-43627",
"@id": "CVE-2023-43627",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39222",
"@id": "CVE-2023-39222",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39429",
"@id": "CVE-2023-39429",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41086",
"@id": "CVE-2023-41086",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-42771",
"@id": "CVE-2023-42771",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43627",
"@id": "CVE-2023-43627",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-22",
"@title": "Path Traversal(CWE-22)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/288.html",
"@id": "CWE-288",
"@title": "Authentication Bypass Using an Alternate Path or Channel(CWE-288)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-352",
"@title": "Cross-Site Request Forgery(CWE-352)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode"
}