CVE-2023-23296 Denial of service in n/a

Medium 6.5 Published 23 Feb 2023 Updated 17 Mar 2025

Attackers can cause a denial of service on Korenix JetWave routers by accessing a specific form endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-23296?

CVE-2023-23296 is a medium-severity denial of service vulnerability in n/a, published on 23 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.

Weakness: CWE-400

Which versions are affected by CVE-2023-23296?

It affects 15 products.

Products include Korenix Jetwave 2111 Firmware, Korenix Jetwave 2111l Firmware, Korenix Jetwave 2114 Firmware, Korenix Jetwave 2211c Firmware, Korenix Jetwave 2212g Firmware, Korenix Jetwave 2212s Firmware and 9 more.

How do I fix CVE-2023-23296?

No fix has been published for CVE-2023-23296 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-23296 being exploited?

There is no known exploitation of CVE-2023-23296 in the wild and no public exploit code.

Sources

Also known as GHSA-3c7c-p4m9-gwhc.