Cross-site request forgery in FURUNO SYSTEMS products - CVE-2023-41086

Vulnerability identifier: #VU81412

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-41086

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

ACERA 1010
ACERA 810
ACERA 850M
ACERA 800ST
ACERA 900
ACERA 850F
ACERA 950
ACERA 1020
ACERA 1110
ACERA 1150w
ACERA 1150i
ACERA 1210

Install updates from vendor's website.

ACERA 1010 - update to 01.90
ACERA 850F - update to 01.70
ACERA 950 - update to 01.70
ACERA 1020 - update to 01.90
ACERA 1110 - update to 01.80
ACERA 1150w - update to 01.40
ACERA 1150i - update to 01.40
ACERA 1210 - update to 02.40

• https://www.furunosystems.co.jp/news/info/vulner20231002.html
• https://jvn.jp/en/vu/JVNVU94497038/

• Multiple vulnerabilities in FURUNO SYSTEMS wireless LAN access point devices