CVE-2023-39429 : Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to i

Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.

Published 2023-10-03 01:15:57

Updated 2023-10-04 17:08:59

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2023-39429

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 19 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-39429

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-39429

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-39429

https://www.furunosystems.co.jp/news/info/vulner20231002.html

【重要】無線LANアクセスポイント「STモード」における複数の脆弱性と対処方法について | 業務用wifi(無線lan)のフルノシステムズ
Vendor Advisory

CVEs referencing this url
https://jvn.jp/en/vu/JVNVU94497038/

JVNVU#94497038: Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2023-39429

Furunosystems » Acera 1210 Firmware
Versions up to, including, (<=) 02.36
cpe:2.3:o:furunosystems:acera_1210_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1210 » Version: N/A
Furunosystems » Acera 1150i Firmware
Versions up to, including, (<=) 01.35
cpe:2.3:o:furunosystems:acera_1150i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1150i » Version: N/A
Furunosystems » Acera 1150w Firmware
Versions up to, including, (<=) 01.35
cpe:2.3:o:furunosystems:acera_1150w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1150w » Version: N/A
Furunosystems » Acera 1110 Firmware
Versions up to, including, (<=) 01.76
cpe:2.3:o:furunosystems:acera_1110_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1110 » Version: N/A
Furunosystems » Acera 1020 Firmware
Versions up to, including, (<=) 01.86
cpe:2.3:o:furunosystems:acera_1020_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1020 » Version: N/A
Furunosystems » Acera 1010 Firmware
Versions up to, including, (<=) 01.86
cpe:2.3:o:furunosystems:acera_1010_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 1010 » Version: N/A
Furunosystems » Acera 950 Firmware
Versions up to, including, (<=) 01.60
cpe:2.3:o:furunosystems:acera_950_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 950 » Version: N/A
Furunosystems » Acera 850f Firmware
Versions up to, including, (<=) 01.60
cpe:2.3:o:furunosystems:acera_850f_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 850f » Version: N/A
Furunosystems » Acera 900 Firmware
Versions up to, including, (<=) 02.54
cpe:2.3:o:furunosystems:acera_900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 900 » Version: N/A
Furunosystems » Acera 850m Firmware
Versions up to, including, (<=) 02.06
cpe:2.3:o:furunosystems:acera_850m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 850m » Version: N/A
Furunosystems » Acera 810 Firmware
Versions up to, including, (<=) 03.74
cpe:2.3:o:furunosystems:acera_810_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 810 » Version: N/A
Furunosystems » Acera 800st Firmware
Versions up to, including, (<=) 07.35
cpe:2.3:o:furunosystems:acera_800st_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Furunosystems » Acera 800st » Version: N/A

Vulnerability Details : CVE-2023-39429

Exploit prediction scoring system (EPSS) score for CVE-2023-39429

CVSS scores for CVE-2023-39429

CWE ids for CVE-2023-39429

References for CVE-2023-39429

Products affected by CVE-2023-39429