by Kastro
Paper/Archive/CVE-2023-5347

CVE-2023-5347

Korenix JetNet Series — Unauthenticated Firmware Upgrade

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.3.713 × 2014.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.

Affected

ProductAffectedFixed inSource
JetNet Seriesfirmware older than 2024/01–CNA

Scores by source

CyberDanube (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refbeijerelectronics.com/en/support/Help___online?docId=69947refcyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-seriesrefseclists.org/fulldisclosure/2024/Jan/11refpacketstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html