Vulnerability-Lookup

CVE-2023-42771 (GCVE-0-2023-42771)

Vulnerability from cvelistv5 – Published: 2023-10-03 00:17 – Updated: 2024-09-20 13:36

Summary

Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-20 13:36 UTC

CWE

Authentication bypass
CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.furunosystems.co.jp/news/info/vulner2…
https://jvn.jp/en/vu/JVNVU94497038/

Impacted products

4 products

Vendor	Product	Version	CPE status
FURUNO SYSTEMS Co.,Ltd.	ACERA 1320	Affected: firmware ver.01.26 and earlier	guessed
FURUNO SYSTEMS Co.,Ltd.	ACERA 1310	Affected: firmware ver.01.26 and earlier	guessed
furunosystems	acera_1320_firmware	Affected: 0 , ≤ 01.26 (custom) cpe:2.3:o:furunosystems:acera_1320_firmware:-:::::::*
furunosystems	acera_1310_firmware	Affected: 0 , ≤ 01.26 (custom) cpe:2.3:o:furunosystems:acera_1310_firmware:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:30:24.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_1320_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "01.26",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "acera_1310_firmware",
            "vendor": "furunosystems",
            "versions": [
              {
                "lessThanOrEqual": "01.26",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-42771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T13:36:23.487612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T13:36:28.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T00:17:00.358Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94497038/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42771",
    "datePublished": "2023-10-03T00:17:00.358Z",
    "dateReserved": "2023-09-22T04:36:33.436Z",
    "dateUpdated": "2024-09-20T13:36:28.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-42771",
      "date": "2026-09-16",
      "epss": "0.00332",
      "percentile": "0.26424"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"01.26\", \"matchCriteriaId\": \"5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D97D14B5-1763-44C0-8EED-A3F787A97A8C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"01.26\", \"matchCriteriaId\": \"4F94D3C1-940A-4A09-B99B-9BB79B73EA63\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de omisi\\u00f3n de autenticaci\\u00f3n en el firmware ACERA 1320 versi\\u00f3n 01.26 y anteriores, y en el firmware ACERA 1310 versi\\u00f3n 01.26 y anteriores, permite que un atacante no autenticado adyacente a la red que puede acceder al producto afectado descargue archivos de configuraci\\u00f3n y/o archivos de registro, y cargue archivos de configuraci\\u00f3n y /o firmware. Se ven afectados cuando se ejecutan en modo ST (independiente).\"}]",
      "id": "CVE-2023-42771",
      "lastModified": "2024-11-21T08:23:07.800",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 8.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.5}]}",
      "published": "2023-10-03T01:15:56.967",
      "references": "[{\"url\": \"https://jvn.jp/en/vu/JVNVU94497038/\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.furunosystems.co.jp/news/info/vulner20231002.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jvn.jp/en/vu/JVNVU94497038/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.furunosystems.co.jp/news/info/vulner20231002.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-288\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-42771\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2023-10-03T01:15:56.967\",\"lastModified\":\"2026-06-17T06:24:28.283\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el firmware ACERA 1320 versi\u00f3n 01.26 y anteriores, y en el firmware ACERA 1310 versi\u00f3n 01.26 y anteriores, permite que un atacante no autenticado adyacente a la red que puede acceder al producto afectado descargue archivos de configuraci\u00f3n y/o archivos de registro, y cargue archivos de configuraci\u00f3n y /o firmware. Se ven afectados cuando se ejecutan en modo ST (independiente).\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"FURUNO SYSTEMS Co.,Ltd.\",\"product\":\"ACERA 1320\",\"versions\":[{\"version\":\"firmware ver.01.26 and earlier\",\"status\":\"affected\"}]},{\"vendor\":\"FURUNO SYSTEMS Co.,Ltd.\",\"product\":\"ACERA 1310\",\"versions\":[{\"version\":\"firmware ver.01.26 and earlier\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"furunosystems\",\"product\":\"acera_1320_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.26\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"furunosystems\",\"product\":\"acera_1310_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.26\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-20T13:36:23.487612Z\",\"id\":\"CVE-2023-42771\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-288\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"01.26\",\"matchCriteriaId\":\"5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D97D14B5-1763-44C0-8EED-A3F787A97A8C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"01.26\",\"matchCriteriaId\":\"4F94D3C1-940A-4A09-B99B-9BB79B73EA63\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/vu/JVNVU94497038/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.furunosystems.co.jp/news/info/vulner20231002.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jvn.jp/en/vu/JVNVU94497038/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.furunosystems.co.jp/news/info/vulner20231002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:22:20+00:00",
      "cve": "CVE-2023-42771",
      "id": "CVE-2023-42771",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2023-42771",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-42771.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.furunosystems.co.jp/news/info/vulner20231002.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/vu/JVNVU94497038/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:30:24.335Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-42771\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-20T13:36:23.487612Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"furunosystems\", \"product\": \"acera_1320_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"01.26\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"furunosystems\", \"product\": \"acera_1310_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"01.26\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-288\", \"description\": \"CWE-288 Authentication Bypass Using an Alternate Path or Channel\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-20T13:36:13.884Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"FURUNO SYSTEMS Co.,Ltd.\", \"product\": \"ACERA 1320\", \"versions\": [{\"status\": \"affected\", \"version\": \"firmware ver.01.26 and earlier\"}]}, {\"vendor\": \"FURUNO SYSTEMS Co.,Ltd.\", \"product\": \"ACERA 1310\", \"versions\": [{\"status\": \"affected\", \"version\": \"firmware ver.01.26 and earlier\"}]}], \"references\": [{\"url\": \"https://www.furunosystems.co.jp/news/info/vulner20231002.html\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU94497038/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Authentication bypass\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2023-10-03T00:17:00.358Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-42771\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-20T13:36:28.745Z\", \"dateReserved\": \"2023-09-22T04:36:33.436Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2023-10-03T00:17:00.358Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-42771

Vulnerability from fkie_nvd - Published: 2023-10-03 01:15 - Updated: 2026-06-17 06:24

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.3 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

References

URL	Tags
vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU94497038/	Third Party Advisory
vultures@jpcert.or.jp	https://www.furunosystems.co.jp/news/info/vulner20231002.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/vu/JVNVU94497038/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.furunosystems.co.jp/news/info/vulner20231002.html	Vendor Advisory

Impacted products

Vendor	Product	Version
furunosystems	acera_1310_firmware	*
furunosystems	acera_1310	-
furunosystems	acera_1320_firmware	*
furunosystems	acera_1320	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ACERA 1320",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "product": "ACERA 1310",
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:furunosystems:acera_1320_firmware:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "acera_1320_firmware",
          "vendor": "furunosystems",
          "versions": [
            {
              "lessThanOrEqual": "01.26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:furunosystems:acera_1310_firmware:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "acera_1310_firmware",
          "vendor": "furunosystems",
          "versions": [
            {
              "lessThanOrEqual": "01.26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64",
              "versionEndIncluding": "01.26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D97D14B5-1763-44C0-8EED-A3F787A97A8C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F94D3C1-940A-4A09-B99B-9BB79B73EA63",
              "versionEndIncluding": "01.26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el firmware ACERA 1320 versi\u00f3n 01.26 y anteriores, y en el firmware ACERA 1310 versi\u00f3n 01.26 y anteriores, permite que un atacante no autenticado adyacente a la red que puede acceder al producto afectado descargue archivos de configuraci\u00f3n y/o archivos de registro, y cargue archivos de configuraci\u00f3n y /o firmware. Se ven afectados cuando se ejecutan en modo ST (independiente)."
    }
  ],
  "id": "CVE-2023-42771",
  "lastModified": "2026-06-17T06:24:28.283",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-42771",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-20T13:36:23.487612Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-10-03T01:15:56.967",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94497038/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94497038/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-J2MJ-6C7W-RH5M

Vulnerability from github – Published: 2023-10-03 03:31 – Updated: 2024-04-04 08:01

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-42771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-288"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T01:15:56Z",
    "severity": "HIGH"
  },
  "details": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.",
  "id": "GHSA-j2mj-6c7w-rh5m",
  "modified": "2024-04-04T08:01:55Z",
  "published": "2023-10-03T03:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42771"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU94497038"
    },
    {
      "type": "WEB",
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-42771

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-42771

Aliases

CVE-2023-42771

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-42771",
    "id": "GSD-2023-42771"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-42771"
      ],
      "details": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode.",
      "id": "GSD-2023-42771",
      "modified": "2023-12-13T01:20:21.865856Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2023-42771",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ACERA 1320",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "firmware ver.01.26 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ACERA 1310",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "firmware ver.01.26 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "FURUNO SYSTEMS Co.,Ltd."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Authentication bypass"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
            "refsource": "MISC",
            "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
          },
          {
            "name": "https://jvn.jp/en/vu/JVNVU94497038/",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/vu/JVNVU94497038/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "01.26",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2023-42771"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94497038/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/vu/JVNVU94497038/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-10-04T21:05Z",
      "publishedDate": "2023-10-03T01:15Z"
    }
  }
}

JVNDB-2023-003767

Vulnerability from jvndb - Published: 2023-10-03 05:26 - Updated:2024-05-22 09:01

Severity

8.3 (High) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode

Details

Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below. * OS Command Injection (CWE-78) - CVE-2023-39222 * Cross-site Scripting (CWE-79) - CVE-2023-39429 * Cross-Site Request Forgery (CWE-352) - CVE-2023-41086 * Authentication Bypass (CWE-288) - CVE-2023-42771 * Path traversal (CWE-22) - CVE-2023-43627 Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC. JPCERT/CC coordinated with the developer. As a result of the developer's investigation into this report, other vulnerabilities were newly discovered and addressed. The developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU94497038/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39222
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39429
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41086
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-42771
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43627
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39222
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39429
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41086
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-42771
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43627
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Authentication Bypass Using an Alternate Path or Channel(CWE-288)	https://cwe.mitre.org/data/definitions/288.html
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	FURUNO SYSTEMS Co.,Ltd.	ACERA 1010 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1020 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1110 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1150i firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1150w firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1210 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1310 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 1320 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 800ST firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 810 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 850F firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 850M firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 900 firmware
	FURUNO SYSTEMS Co.,Ltd.	ACERA 950 firmware

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
  "dc:date": "2024-05-22T18:01+09:00",
  "dcterms:issued": "2023-10-03T14:26+09:00",
  "dcterms:modified": "2024-05-22T18:01+09:00",
  "description": "Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below.\r\n\r\n* OS Command Injection (CWE-78) - CVE-2023-39222\r\n* Cross-site Scripting (CWE-79) - CVE-2023-39429\r\n* Cross-Site Request Forgery (CWE-352) - CVE-2023-41086\r\n* Authentication Bypass (CWE-288) - CVE-2023-42771\r\n* Path traversal (CWE-22) - CVE-2023-43627\r\n\r\nKatsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.\r\n\r\nAs a result of the developer\u0027s investigation into this report, other vulnerabilities were newly discovered and addressed.\r\nThe developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-003767.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:furunosystems:acera_1010_firmware",
      "@product": "ACERA 1010 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1020_firmware",
      "@product": "ACERA 1020 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1110_firmware",
      "@product": "ACERA 1110 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1150i_firmware",
      "@product": "ACERA 1150i firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1150w_firmware",
      "@product": "ACERA 1150w firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1210_firmware",
      "@product": "ACERA 1210 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1310_firmware",
      "@product": "ACERA 1310 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_1320_firmware",
      "@product": "ACERA 1320 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_800st_firmware",
      "@product": "ACERA 800ST firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_810_firmware",
      "@product": "ACERA 810 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_850f_firmware",
      "@product": "ACERA 850F firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_850m_firmware",
      "@product": "ACERA 850M firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_900_firmware",
      "@product": "ACERA 900 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:furunosystems:acera_950_firmware",
      "@product": "ACERA 950 firmware",
      "@vendor": "FURUNO SYSTEMS Co.,Ltd.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-003767",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94497038/index.html",
      "@id": "JVNVU#94497038",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39222",
      "@id": "CVE-2023-39222",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39429",
      "@id": "CVE-2023-39429",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41086",
      "@id": "CVE-2023-41086",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-42771",
      "@id": "CVE-2023-42771",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43627",
      "@id": "CVE-2023-43627",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39222",
      "@id": "CVE-2023-39222",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39429",
      "@id": "CVE-2023-39429",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41086",
      "@id": "CVE-2023-41086",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-42771",
      "@id": "CVE-2023-42771",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43627",
      "@id": "CVE-2023-43627",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/288.html",
      "@id": "CWE-288",
      "@title": "Authentication Bypass Using an Alternate Path or Channel(CWE-288)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-42771 (GCVE-0-2023-42771)

FKIE_CVE-2023-42771

GHSA-J2MJ-6C7W-RH5M

GSD-2023-42771

JVNDB-2023-003767

Tags

Sightings

Nomenclature

Related by attack behaviour