PT-2023-18890 · Korenix · Korenix Jetwave 3000 Series+1

Published 2023-02-23 · Updated 2023-10-10 · CVE-2023-23295

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Korenix Jetwave 4200 Series version 1.3.0 Korenix JetWave 3000 Series version 1.6.0

Description The issue allows for Command Injection via the "/goform/formSysCmd" API endpoint. An attacker can modify the sysCmd parameter to execute commands as root.

Recommendations For Korenix Jetwave 4200 Series version 1.3.0, consider disabling access to the "/goform/formSysCmd" API endpoint until a patch is available. For Korenix JetWave 3000 Series version 1.6.0, restrict the use of the sysCmd parameter in the "/goform/formSysCmd" API endpoint to prevent command injection attacks.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-23295

Affected Products

Korenix Jetwave 3000 Series

Korenix Jetwave 4200 Series

References · 6

• 🔥 https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-23295 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23295 · Vendor Advisory
• https://t.me/aptreports/5862 · Telegram Post
• https://t.me/aptreports/5860 · Telegram Post
• https://t.me/cibsecurity/58838 · Telegram Post