CVE-2023-28392 - OpenCVE

Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Inaba	Ac-wapu-300 Ac-wapu-300-p Ac-wapu-300-p Firmware Ac-wapu-300 Firmware Ac-wapum-300 Ac-wapum-300-p Ac-wapum-300-p Firmware Ac-wapum-300 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:inaba:ac-wapu-300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapu-300:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:inaba:ac-wapu-300-p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapu-300-p:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:inaba:ac-wapum-300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapum-300:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:inaba:ac-wapum-300-p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapum-300-p:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN28412757/
https://jvn.jp/en/vu/JVNVU98968780/
https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2023-05-23T00:00:00

Updated: 2024-08-02T12:38:25.228Z

Reserved: 2023-03-15T00:00:00

Link: CVE-2023-28392

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-05-23T02:15:10.140

Modified: 2023-06-09T06:16:00.853

Link: CVE-2023-28392

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-28392", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "dateUpdated": "2024-08-02T12:38:25.228Z", "dateReserved": "2023-03-15T00:00:00", "datePublished": "2023-05-23T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-06-09T00:00:00"}, "descriptions": [{"lang": "en", "value": "Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command."}], "affected": [{"vendor": "Inaba Denki Sangyo Co., Ltd.", "product": "Wi-Fi AP UNIT", "versions": [{"version": "AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier", "status": "affected"}]}], "references": [{"url": "https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf"}, {"url": "https://jvn.jp/en/vu/JVNVU98968780/"}, {"url": "https://jvn.jp/en/jp/JVN28412757/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "OS Command Injection"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T12:38:25.228Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU98968780/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN28412757/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inaba:ac-wapu-300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "68C8C3E3-E6C2-4CBE-B5ED-EC030060E692", "versionEndIncluding": "1.00_b07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inaba:ac-wapu-300:-:*:*:*:*:*:*:*", "matchCriteriaId": "383369D2-D9D1-44F6-8323-712805103579", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inaba:ac-wapu-300-p_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "23DD3254-ED6C-4DA1-B0BC-F6FD3343C8E1", "versionEndIncluding": "1.00_b08p", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inaba:ac-wapu-300-p:-:*:*:*:*:*:*:*", "matchCriteriaId": "962D58E3-E4AE-46B6-9788-156C6AD995EC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inaba:ac-wapum-300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA85541E-423A-4029-A5AF-AAA01A021DBD", "versionEndIncluding": "1.00_b07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inaba:ac-wapum-300:-:*:*:*:*:*:*:*", "matchCriteriaId": "305906A3-AAA3-4CAD-A72D-B46838BA255F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inaba:ac-wapum-300-p_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B26B63B7-01FF-4B5C-A3B1-68C4D765697E", "versionEndIncluding": "1.00_b08p", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inaba:ac-wapum-300-p:-:*:*:*:*:*:*:*", "matchCriteriaId": "C1B508D0-8D80-4308-ABC0-77A2F20359AF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command."}], "id": "CVE-2023-28392", "lastModified": "2023-06-09T06:16:00.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-23T02:15:10.140", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN28412757/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU98968780/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}