CVE-2023-5347
CRITICALCVSS 9.1/10EPSS 1.34%
Last modified
CVE-2023-5347 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.. EPSS estimates a 1.34% chance of exploitation in the next 30 days.
Description
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Korenix | Jetnet 5310g Firmware | 2.6 |
| Korenix | Jetnet 4508 Firmware | 2.3 |
| Korenix | Jetnet 4508i-W Firmware | 1.3 |
| Korenix | Jetnet 4508-W Firmware | 2.3 |
| Korenix | Jetnet 4508if-S Firmware | 1.3 |
| Korenix | Jetnet 4508if-M Firmware | 1.3 |
| Korenix | Jetnet 4508if-Sw Firmware | 1.3 |
| Korenix | Jetnet 4508if-Mw Firmware | 1.3 |
| Korenix | Jetnet 4508f-M Firmware | 2.3 |
| Korenix | Jetnet 4508f-S Firmware | 2.3 |
| Korenix | Jetnet 4508f-Mw Firmware | 2.3 |
| Korenix | Jetnet 4508f-Sw Firmware | 2.3 |
| Korenix | Jetnet 5620g-4c Firmware | 1.1 |
| Korenix | Jetnet 5612gp-4f Firmware | 1.2 |
| Korenix | Jetnet 5612g-4f Firmware | 1.2 |
| Korenix | Jetnet 5728g-24p-Ac-2dc-Us Firmware | 2.1 |
| Korenix | Jetnet 5728g-24p-Ac-2dc-Eu Firmware | 2.1 |
| Korenix | Jetnet 6528gf-2ac-Eu Firmware | 1.0 |
| Korenix | Jetnet 6528gf-2ac-Us Firmware | 1.0 |
| Korenix | Jetnet 6528gf-2dc24 Firmware | 1.0 |
| Korenix | Jetnet 6528gf-2dc48 Firmware | 1.0 |
| Korenix | Jetnet 6528gf-Ac-Eu Firmware | 1.0 |
| Korenix | Jetnet 6528gf-Ac-Us Firmware | 1.0 |
| Korenix | Jetnet 6628xp-4f-Us Firmware | 1.1 |
| Korenix | Jetnet 6628x-4f-Eu Firmware | 1.0 |
| Korenix | Jetnet 6728g-24p-Ac-2dc-Us Firmware | 1.1 |
| Korenix | Jetnet 6728g-24p-Ac-2dc-Eu Firmware | 1.1 |
| Korenix | Jetnet 6828gf-2dc48 Firmware | 1.0 |
| Korenix | Jetnet 6828gf-2dc24 Firmware | 1.0 |
| Korenix | Jetnet 6828gf-Ac-Dc24-Us Firmware | 1.0 |
| Korenix | Jetnet 6828gf-2ac-Us Firmware | 1.0 |
| Korenix | Jetnet 6828gf-Ac-Us Firmware | 1.0 |
| Korenix | Jetnet 6828gf-2ac-Au Firmware | 1.0 |
| Korenix | Jetnet 6828gf-Ac-Dc24-Eu Firmware | 1.0 |
| Korenix | Jetnet 6828gf-2ac-Eu Firmware | 1.0 |
| Korenix | Jetnet 6910g-M12 Hvdc Firmware | 1.0 |
| Korenix | Jetnet 7310g-V2 Firmware | 1.0 |
| Korenix | Jetnet 7628xp-4f-Us Firmware | 1.0 |
| Korenix | Jetnet 7628xp-4f-Us Firmware | 1.1 |
| Korenix | Jetnet 7628xp-4f-Eu Firmware | 1.0 |
| Korenix | Jetnet 7628xp-4f-Eu Firmware | 1.1 |
| Korenix | Jetnet 7628x-4f-Us Firmware | 1.0 |
| Korenix | Jetnet 7628x-4f-Eu Firmware | 1.0 |
| Korenix | Jetnet 7714g-M12 Hvdc Firmware | 1.0 |
References
- http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2024/Jan/11Exploit, Mailing List, Third Party Advisory
- https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2024/Jan/11Exploit, Mailing List, Third Party Advisory
- https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-5347?
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
How severe is CVE-2023-5347?
CVE-2023-5347 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 1.34% probability of exploitation in the next 30 days.
How do I fix CVE-2023-5347?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-53464In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53465In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2023-53466In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53467In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53468In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53469Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2023-53470In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53471In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2023-53472In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53473In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2023-53474In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2023-53475In the Linux kernel, the following vulnerability has been re…5.5
Are you affected by CVE-2023-5347?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST