Most recent entries from all

EUVD-2026-187015

fkie_cve-2023-39429

Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.

GHSA-4r8h-f85r-q588

gsd-2023-39429

jvndb-2023-003767

Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in ST(Standalone) mode, contain multiple vulnerabilities listed below. * OS Command Injection (CWE-78) - CVE-2023-39222 * Cross-site Scripting (CWE-79) - CVE-2023-39429 * Cross-Site Request Forgery (CWE-352) - CVE-2023-41086 * Authentication Bypass (CWE-288) - CVE-2023-42771 * Path traversal (CWE-22) - CVE-2023-43627 Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported OS Command Injection vulnerability (CVE-2023-39222) to JPCERT/CC. JPCERT/CC coordinated with the developer. As a result of the developer's investigation into this report, other vulnerabilities were newly discovered and addressed. The developer reported these vulnerabilities to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.