Korenix Vulnerabilities and Affected Products

Products

JetNet5 vulnerabilities
JetPort 5601v33 vulnerabilities
JetNet Series2 vulnerabilities
jetport_56012 vulnerabilities
JetI/O 65501 vulnerability
JetPort 56011 vulnerability
jetport5601v31 vulnerability
jetport_5601v31 vulnerability
jetwave_2212g_firmware1 vulnerability

Korenix vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-11303HIGH	Path Traversal The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2. CWE-22Nov 18, 20241 related artifact	CVSS8.7v4.0	EPSS1.8%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-7397CRITICAL	Unauthenticated Command Injection Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2. CWE-77Aug 5, 2024	CVSS9.3v4.0	EPSS1.38%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-7396HIGH	Plaintext Communication Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2. CWE-311Aug 5, 2024	CVSS7.1v4.0	EPSS0.295%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-7395CRITICAL	Insufficient Authentication An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2. CWE-287Aug 5, 2024	CVSS9.3v4.0	EPSS0.898%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-2371MEDIUM	Information exposure vulnerability in Korenix JetI/O 6550 Information exposure vulnerability in Korenix JetI/O 6550 affecting firmware version F208 Build:0817. The SNMP protocol uses plaintext to transfer data, allowing an attacker to intercept traffic and retrieve credentials. CWE-200Mar 12, 2024	CVSS6.2v3.1	EPSS0.183%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-5347CRITICAL	Unauthenticated Firmware Upgrade An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01. CWE-327 CWE-347Jan 9, 2024	CVSS9.8v3.1	EPSS1.34%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-5376HIGH	TFTP Without Authentication An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01. CWE-287 CWE-306Jan 9, 2024	CVSS8.6v3.1	EPSS1.41%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-23295HIGH	korenix jetwave_2212g_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection') Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root. CWE-77Feb 23, 2023	CVSS8.8v3.1	EPSS3.83%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-12504CRITICAL	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service. CWE-863 CWE-912Oct 15, 2020	CVSS9.8v3.1	EPSS3.02%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-12503HIGH	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections. CWE-20 CWE-863Oct 15, 2020	CVSS7.2v3.1	EPSS23.3%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-12502HIGH	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration. CWE-352Oct 15, 2020	CVSS8.8v3.1	EPSS1.03%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-12501CRITICAL	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts. CWE-798Oct 15, 2020	CVSS9.8v3.1	EPSS3.34%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-12500CRITICAL	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration. CWE-285 CWE-306 CWE-863Oct 15, 2020	CVSS9.8v3.1	EPSS2.89%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX