PT-2023-26840 · Furuno Systems · Acera 1210+13

Goroh_Kun + 1 · Published 2023-10-02 · Updated 2023-10-04 · CVE-2023-39222

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FURUNO SYSTEMS ACERA 1320 firmware versions 01.26 and earlier FURUNO SYSTEMS ACERA 1310 firmware versions 01.26 and earlier FURUNO SYSTEMS ACERA 1210 firmware versions 02.36 and earlier FURUNO SYSTEMS ACERA 1150i firmware versions 01.35 and earlier FURUNO SYSTEMS ACERA 1150w firmware versions 01.35 and earlier FURUNO SYSTEMS ACERA 1110 firmware versions 01.76 and earlier FURUNO SYSTEMS ACERA 1020 firmware versions 01.86 and earlier FURUNO SYSTEMS ACERA 1010 firmware versions 01.86 and earlier FURUNO SYSTEMS ACERA 950 firmware versions 01.60 and earlier FURUNO SYSTEMS ACERA 850F firmware versions 01.60 and earlier FURUNO SYSTEMS ACERA 900 firmware versions 02.54 and earlier FURUNO SYSTEMS ACERA 850M firmware versions 02.06 and earlier FURUNO SYSTEMS ACERA 810 firmware versions 03.74 and earlier FURUNO SYSTEMS ACERA 800ST firmware versions 07.35 and earlier

Description An OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. The affected devices are running in ST (Standalone) mode.

Recommendations For FURUNO SYSTEMS ACERA 1320 firmware versions 01.26 and earlier, update to a version later than 01.26. For FURUNO SYSTEMS ACERA 1310 firmware versions 01.26 and earlier, update to a version later than 01.26. For FURUNO SYSTEMS ACERA 1210 firmware versions 02.36 and earlier, update to a version later than 02.36. For FURUNO SYSTEMS ACERA 1150i firmware versions 01.35 and earlier, update to a version later than 01.35. For FURUNO SYSTEMS ACERA 1150w firmware versions 01.35 and earlier, update to a version later than 01.35. For FURUNO SYSTEMS ACERA 1110 firmware versions 01.76 and earlier, update to a version later than 01.76. For FURUNO SYSTEMS ACERA 1020 firmware versions 01.86 and earlier, update to a version later than 01.86. For FURUNO SYSTEMS ACERA 1010 firmware versions 01.86 and earlier, update to a version later than 01.86. For FURUNO SYSTEMS ACERA 950 firmware versions 01.60 and earlier, update to a version later than 01.60. For FURUNO SYSTEMS ACERA 850F firmware versions 01.60 and earlier, update to a version later than 01.60. For FURUNO SYSTEMS ACERA 900 firmware versions 02.54 and earlier, update to a version later than 02.54. For FURUNO SYSTEMS ACERA 850M firmware versions 02.06 and earlier, update to a version later than 02.06. For FURUNO SYSTEMS ACERA 810 firmware versions 03.74 and earlier, update to a version later than 03.74. For FURUNO SYSTEMS ACERA 800ST firmware versions 07.35 and earlier, update to a version later than 07.35. As a temporary workaround, consider restricting access to the web interface until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-39222

Affected Products

Acera 1010

Acera 1020

Acera 1110

Acera 1150I

Acera 1150W

Acera 1210

Acera 1310

Acera 1320

Acera 800St

Acera 810

Acera 850F

Acera 850M

Acera 900

Acera 950

References · 7

• https://osv.dev/vulnerability/CVE-2023-39222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39222 · Security Note
• https://furunosystems.co.jp/news/info/vulner20231002.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1709025811418743070 · Twitter Post
• https://t.me/cibsecurity/71462 · Telegram Post
• https://jvn.jp/en/vu/JVNVU94497038 · Note
• https://twitter.com/VulmonFeeds/status/1709081485389500782 · Twitter Post