Vulnerability-Lookup

CVE-2023-43627 (GCVE-0-2023-43627)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:18 – Updated: 2024-09-20 15:10

Summary

Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-20 15:08 UTC

CWE

Path traversal

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 186 records in the last 180 days details

References

2 references

URL	Tags
https://www.furunosystems.co.jp/news/info/vulner2…
https://jvn.jp/en/vu/JVNVU94497038/

Impacted products

2 products

Vendor	Product	Version	CPE status
FURUNO SYSTEMS Co.,Ltd.	ACERA 1320	Affected: firmware ver.01.26 and earlier	guessed
FURUNO SYSTEMS Co.,Ltd.	ACERA 1310	Affected: firmware ver.01.26 and earlier	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T15:08:52.656163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T15:10:16.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:18:13.113Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43627",
    "datePublished": "2023-10-03T00:18:13.113Z",
    "dateReserved": "2023-09-22T04:36:31.640Z",
    "dateUpdated": "2024-09-20T15:10:16.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-43627",
      "date": "2026-10-14",
      "epss": "0.00314",
      "percentile": "0.22668"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "ACERA 1320",
                "vendor": "FURUNO SYSTEMS Co.,Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "firmware ver.01.26 and earlier"
                  }
                ]
              },
              {
                "product": "ACERA 1310",
                "vendor": "FURUNO SYSTEMS Co.,Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "firmware ver.01.26 and earlier"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64",
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D97D14B5-1763-44C0-8EED-A3F787A97A8C",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F94D3C1-940A-4A09-B99B-9BB79B73EA63",
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de path traversal en el firmware ACERA 1320 versi\u00f3n 01.26 y anteriores, y en el firmware ACERA 1310 versi\u00f3n 01.26 y anteriores permite que un atacante autenticado adyacente a la red altere informaci\u00f3n cr\u00edtica, como archivos del sistema, mediante el env\u00edo de una solicitud especialmente manipulada. Se ven afectados cuando se ejecutan en modo ST (Standalone)."
          }
        ],
        "id": "CVE-2023-43627",
        "lastModified": "2026-06-17T06:26:06.153",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-43627",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T15:08:52.656163Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-10-03T01:15:57.017",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T19:44:43.669Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/vu/JVNVU94497038/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-43627",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-20T15:08:52.656163Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-20T15:09:01.530Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "ACERA 1320",
              "vendor": "FURUNO SYSTEMS Co.,Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "firmware ver.01.26 and earlier"
                }
              ]
            },
            {
              "product": "ACERA 1310",
              "vendor": "FURUNO SYSTEMS Co.,Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "firmware ver.01.26 and earlier"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Path traversal",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-03T00:18:13.113Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
            },
            {
              "url": "https://jvn.jp/en/vu/JVNVU94497038/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2023-43627",
        "datePublished": "2023-10-03T00:18:13.113Z",
        "dateReserved": "2023-09-22T04:36:31.640Z",
        "dateUpdated": "2024-09-20T15:10:16.976Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-43627

Vulnerability from fkie_nvd - Published: 2023-10-03 01:15 - Updated: 2026-06-17 06:26

Severity

5.7 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU94497038/	Third Party Advisory
vultures@jpcert.or.jp	https://www.furunosystems.co.jp/news/info/vulner20231002.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/vu/JVNVU94497038/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.furunosystems.co.jp/news/info/vulner20231002.html	Vendor Advisory

Impacted products

Vendor	Product	Version
furunosystems	acera_1310_firmware	*
furunosystems	acera_1310	-
furunosystems	acera_1320_firmware	*
furunosystems	acera_1320	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64",
              "versionEndIncluding": "01.26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D97D14B5-1763-44C0-8EED-A3F787A97A8C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F94D3C1-940A-4A09-B99B-9BB79B73EA63",
              "versionEndIncluding": "01.26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de path traversal en el firmware ACERA 1320 versi\u00f3n 01.26 y anteriores, y en el firmware ACERA 1310 versi\u00f3n 01.26 y anteriores permite que un atacante autenticado adyacente a la red altere informaci\u00f3n cr\u00edtica, como archivos del sistema, mediante el env\u00edo de una solicitud especialmente manipulada. Se ven afectados cuando se ejecutan en modo ST (Standalone)."
    }
  ],
  "id": "CVE-2023-43627",
  "lastModified": "2026-06-17T06:26:06.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43627",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-20T15:08:52.656163Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-10-03T01:15:57.017",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94497038/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94497038/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-XJF4-CG52-RF4G

Vulnerability from github – Published: 2023-10-03 03:31 – Updated: 2024-04-04 08:01

Details

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-43627"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T01:15:57Z",
    "severity": "MODERATE"
  },
  "details": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.",
  "id": "GHSA-xjf4-cg52-rf4g",
  "modified": "2024-04-04T08:01:57Z",
  "published": "2023-10-03T03:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43627"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU94497038"
    },
    {
      "type": "WEB",
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-43627

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-43627

Aliases

CVE-2023-43627

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-43627",
    "id": "GSD-2023-43627"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-43627"
      ],
      "details": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.",
      "id": "GSD-2023-43627",
      "modified": "2023-12-13T01:20:44.717849Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2023-43627",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ACERA 1320",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "firmware ver.01.26 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ACERA 1310",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "firmware ver.01.26 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "FURUNO SYSTEMS Co.,Ltd."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Path traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
            "refsource": "MISC",
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "name": "https://jvn.jp/en/vu/JVNVU94497038/",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2023-43627"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94497038/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/vu/JVNVU94497038/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-10-04T21:03Z",
      "publishedDate": "2023-10-03T01:15Z"
    }
  }
}

JVNDB-2023-003767

Vulnerability from jvndb - Published: 2023-10-03 05:26 - Updated:2024-05-22 09:01

Severity

8.3 (High) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode

Details

Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below. * OS Command Injection (CWE-78) - CVE-2023-39222 * Cross-site Scripting (CWE-79) - CVE-2023-39429 * Cross-Site Request Forgery (CWE-352) - CVE-2023-41086 * Authentication Bypass (CWE-288) - CVE-2023-42771 * Path traversal (CWE-22) - CVE-2023-43627 Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC. JPCERT/CC coordinated with the developer. As a result of the developer's investigation into this report, other vulnerabilities were newly discovered and addressed. The developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU94497038/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39222
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39429
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41086
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-42771
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43627
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39222
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39429
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41086
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-42771
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43627
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Authentication Bypass Using an Alternate Path or Channel(CWE-288)	https://cwe.mitre.org/data/definitions/288.html
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	FURUNO SYSTEMS Co.,Ltd.	ACERA 1010 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1020 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1110 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1150i firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1150w firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1210 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1310 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1320 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 800ST firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 810 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 850F firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 850M firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 900 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 950 firmware

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
  "dc:date": "2024-05-22T18:01+09:00",
  "dcterms:issued": "2023-10-03T14:26+09:00",
  "dcterms:modified": "2024-05-22T18:01+09:00",
  "description": "Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below.\r\n\r\n* OS Command Injection (CWE-78) - CVE-2023-39222\r\n* Cross-site Scripting (CWE-79) - CVE-2023-39429\r\n* Cross-Site Request Forgery (CWE-352) - CVE-2023-41086\r\n* Authentication Bypass (CWE-288) - CVE-2023-42771\r\n* Path traversal (CWE-22) - CVE-2023-43627\r\n\r\nKatsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.\r\n\r\nAs a result of the developer\u0027s investigation into this report, other vulnerabilities were newly discovered and addressed.\r\nThe developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:furunosystems:acera_1010_firmware",
      "@product": "ACERA 1010 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1020_firmware",
      "@product": "ACERA 1020 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1110_firmware",
      "@product": "ACERA 1110 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1150i_firmware",
      "@product": "ACERA 1150i firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1150w_firmware",
      "@product": "ACERA 1150w firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1210_firmware",
      "@product": "ACERA 1210 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1310_firmware",
      "@product": "ACERA 1310 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1320_firmware",
      "@product": "ACERA 1320 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_800st_firmware",
      "@product": "ACERA 800ST firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_810_firmware",
      "@product": "ACERA 810 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_850f_firmware",
      "@product": "ACERA 850F firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_850m_firmware",
      "@product": "ACERA 850M firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_900_firmware",
      "@product": "ACERA 900 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_950_firmware",
      "@product": "ACERA 950 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-003767",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94497038/index.html",
      "@id": "JVNVU#94497038",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39222",
      "@id": "CVE-2023-39222",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39429",
      "@id": "CVE-2023-39429",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41086",
      "@id": "CVE-2023-41086",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-42771",
      "@id": "CVE-2023-42771",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43627",
      "@id": "CVE-2023-43627",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39222",
      "@id": "CVE-2023-39222",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39429",
      "@id": "CVE-2023-39429",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41086",
      "@id": "CVE-2023-41086",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-42771",
      "@id": "CVE-2023-42771",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43627",
      "@id": "CVE-2023-43627",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/288.html",
      "@id": "CWE-288",
      "@title": "Authentication Bypass Using an Alternate Path or Channel(CWE-288)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-43627 (GCVE-0-2023-43627)

FKIE_CVE-2023-43627

GHSA-XJF4-CG52-RF4G

GSD-2023-43627

JVNDB-2023-003767

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour