Vulnerability · Published Jan 9, 2024 · Assigned by CyberDanube
CVE-2023-5347Unauthenticated Firmware Upgrade
Critical 9.8
In plain English
A critical-severity broken cryptography in JetNet Series from Korenix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Korenix | JetNet Series | firmware older than 2024/01 |
Weakness: CWE-347, CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H