Critical severity · published Jan 9, 2024
CVE-2023-5347
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted…
9.1
CVSS
1.3%
EPSS
No
On KEV
Description
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
J4
Jetnet 4508 Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508-w Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508f-m Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508f-mw Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508f-s Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508f-sw Firmware · Korenix
2.3 · source: NVD
J4
Jetnet 4508i-w Firmware · Korenix
1.3 · source: NVD
J4
Jetnet 4508if-m Firmware · Korenix
1.3 · source: NVD
J4
Jetnet 4508if-mw Firmware · Korenix
1.3 · source: NVD
J4
Jetnet 4508if-s Firmware · Korenix
1.3 · source: NVD
J4
Jetnet 4508if-sw Firmware · Korenix
1.3 · source: NVD
J5
Jetnet 5310g Firmware · Korenix
2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5347
Exploit
http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html
Exploit
http://seclists.org/fulldisclosure/2024/Jan/11
Exploit
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/
Vendor Advisory
https://www.beijerelectronics.com/en/support/Help___online?docId=69947
More from Jetnet 4508 Firmware
9.1
CVE-2023-5376
An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01