CVE-2023-38555 Auth bypass in SR-M 50AP1

What is CVE-2023-38555?

CVE-2023-38555 is a high-severity authentication bypass vulnerability in Fujitsu Limited SR-M 50AP1, published on 26 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 90brin all versions, Si-R570B all versions, Si-R370B all versions, Si-R220D all versions, Si-R G100 V02.54 and earlier, Si-R G200 V02.54 and earlier, Si-R G100B V04.12 and earlier, Si-R G110B V04.12 and earlier, Si-R G200B V04.12 and earlier, Si-R G210 V20.52 and earlier, Si-R G211 V20.52 and earlier, Si-R G120 V20.52 and earlier, Si-R G121 V20.52 and earlier, and SR-M 50AP1 all versions.

Weakness: CWE-287

Which versions are affected by CVE-2023-38555?

It affects 16 products.

Products include Fujitsu Si-R220d Firmware, Fujitsu Si-R370b Firmware, Fujitsu Si-R570b Firmware, Fujitsu Si-R 130b Firmware, Fujitsu Si-R 30b Firmware, Fujitsu Si-R 90brin Firmware and 10 more.

How do I fix CVE-2023-38555?

No fix has been published for CVE-2023-38555 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-38555 being exploited?

There is no known exploitation of CVE-2023-38555 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wgrg-g2m9-jr56.