CVE-2023-28392

Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN28412757/
https://jvn.jp/en/vu/JVNVU98968780/	Third Party Advisory
https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:inaba:ac-wapu-300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapu-300:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:inaba:ac-wapu-300-p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapu-300-p:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:inaba:ac-wapum-300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapum-300:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:inaba:ac-wapum-300-p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inaba:ac-wapum-300-p:-:*:*:*:*:*:*:*

History

09 Jun 2023, 06:16

Type	Values Removed	Values Added
References		(MISC) https://jvn.jp/en/jp/JVN28412757/ -
Summary	Wi-Fi AP UNIT AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.	Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command.

30 May 2023, 16:58

Type	Values Removed	Values Added
CPE		cpe:2.3:o:inaba:ac-wapu-300-p_firmware:::::::: cpe:2.3:h:inaba:ac-wapum-300:-:::::::* cpe:2.3:o:inaba:ac-wapum-300-p_firmware:::::::: cpe:2.3:o:inaba:ac-wapu-300_firmware:::::::: cpe:2.3:o:inaba:ac-wapum-300_firmware:::::::: cpe:2.3:h:inaba:ac-wapu-300:-:::::::* cpe:2.3:h:inaba:ac-wapum-300-p:-:::::::* cpe:2.3:h:inaba:ac-wapu-300-p:-:::::::*
First Time		Inaba ac-wapu-300-p Inaba Inaba ac-wapum-300 Firmware Inaba ac-wapum-300 Inaba ac-wapu-300-p Firmware Inaba ac-wapum-300-p Inaba ac-wapu-300 Inaba ac-wapum-300-p Firmware Inaba ac-wapu-300 Firmware
References	(MISC) https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf -	(MISC) https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf - Vendor Advisory
References	~~(MISC) https://jvn.jp/en/vu/JVNVU98968780/ -~~	(MISC) https://jvn.jp/en/vu/JVNVU98968780/ - Third Party Advisory
CWE		CWE-78
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2

Information

Published : 2023-05-23 02:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-28392

Mitre link : CVE-2023-28392

CVE.ORG link : CVE-2023-28392

JSON object : View

Products Affected

inaba

ac-wapum-300
ac-wapu-300
ac-wapu-300-p_firmware
ac-wapu-300_firmware
ac-wapu-300-p
ac-wapum-300_firmware
ac-wapum-300-p
ac-wapum-300-p_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

7.2 /10