CVE-2023-5347 Unauthenticated Firmware Upgrade
Attackers can bypass signature verification to install malicious firmware on Korenix JetNet devices, gaining full control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5347?
CVE-2023-5347 is a critical vulnerability in Korenix JetNet Series, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
Which versions are affected by CVE-2023-5347?
It affects 42 products.
Products include Korenix Jetnet 4508-W Firmware, Korenix Jetnet 4508 Firmware, Korenix Jetnet 4508f-M Firmware, Korenix Jetnet 4508f-Mw Firmware, Korenix Jetnet 4508f-S Firmware, Korenix Jetnet 4508f-Sw Firmware and 36 more.
How do I fix CVE-2023-5347?
No fix has been published for CVE-2023-5347 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5347 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5347 exists.
Other vulnerabilities in Korenix JetNet Series
Sources
Also known as GHSA-3fr9-8m46-r2mm.