OS Command Injection in FURUNO SYSTEMS products - CVE-2023-39222

Vulnerability identifier: #VU81409

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39222

CWE-ID: CWE-78

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

ACERA 1210
ACERA 1150i
ACERA 1310
ACERA 1150w
ACERA 1110
ACERA 1320
ACERA 1020
ACERA 800ST
ACERA 1010
ACERA 810
ACERA 950
ACERA 850M
ACERA 850F
ACERA 900

Install updates from vendor's website.

ACERA 1210 - update to 02.40
ACERA 1150i - update to 01.40
ACERA 1310 - update to 01.41
ACERA 1150w - update to 01.40
ACERA 1110 - update to 01.80
ACERA 1320 - update to 01.41
ACERA 1020 - update to 01.90
ACERA 1010 - update to 01.90
ACERA 950 - update to 01.70
ACERA 850F - update to 01.70

• https://www.furunosystems.co.jp/news/info/vulner20231002.html
• https://jvn.jp/en/vu/JVNVU94497038/

• Multiple vulnerabilities in FURUNO SYSTEMS wireless LAN access point devices