Vulnerability Details : CVE-2023-5347
Potential exploit
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
Products affected by CVE-2023-5347
- cpe:2.3:o:korenix:jetnet_5310g_firmware:2.6:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508i-w_firmware:1.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508-w_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508if-s_firmware:1.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508if-m_firmware:1.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508if-sw_firmware:1.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508if-mw_firmware:1.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508f-m_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508f-s_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508f-mw_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_4508f-sw_firmware:2.3:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_5620g-4c_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_5612gp-4f_firmware:1.2:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_5612g-4f_firmware:1.2:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_5728g-24p-ac-2dc-us_firmware:2.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_5728g-24p-ac-2dc-eu_firmware:2.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-2ac-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-2ac-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-2dc24_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-2dc48_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-ac-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6528gf-ac-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6628xp-4f-us_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6628x-4f-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6728g-24p-ac-2dc-us_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6728g-24p-ac-2dc-eu_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-2dc48_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-2dc24_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-ac-dc24-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-2ac-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-ac-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-2ac-au_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-ac-dc24-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6828gf-2ac-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_6910g-m12_hvdc_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7310g-v2_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628xp-4f-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628xp-4f-us_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628xp-4f-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628xp-4f-eu_firmware:1.1:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628x-4f-us_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7628x-4f-eu_firmware:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:korenix:jetnet_7714g-m12_hvdc_firmware:1.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-5347
1.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-5347
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
3.9
|
5.2
|
NIST | 2024-01-16 |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
CyberDanube | 2024-01-09 |
CWE ids for CVE-2023-5347
-
The product does not verify, or incorrectly verifies, the cryptographic signature for data.Assigned by:
- nvd@nist.gov (Primary)
- office@cyberdanube.com (Secondary)
References for CVE-2023-5347
-
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/
[EN] Multiple Vulnerabilities in Korenix JetNet Series - CyberDanubeExploit;Third Party Advisory
-
http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html
Korenix JetNet Series Unauthenticated Access ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.beijerelectronics.com/en/support/Help___online?docId=69947
Help online - Beijer ElectronicsVendor Advisory
-
http://seclists.org/fulldisclosure/2024/Jan/11
Full Disclosure: CyberDanube Security Research 20240109-0 | Multiple Vulnerabilities in JetNet SeriesExploit;Mailing List;Third Party Advisory
Jump to