« Volver al listado

CVE-2023-43627

Estado: ModificadaMedia (5.7)—

Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Furunosystems — Acera 1310 FirmwareFurunosystems — Acera 1320 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-43627",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43627",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-20T15:08:52.656163Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "product": "ACERA 1320",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        },
        {
          "vendor": "FURUNO SYSTEMS Co.,Ltd.",
          "product": "ACERA 1310",
          "versions": [
            {
              "status": "affected",
              "version": "firmware ver.01.26 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-03T01:15:57.017",
  "references": [
    {
      "url": "https://jvn.jp/en/vu/JVNVU94497038/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/vu/JVNVU94497038/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.furunosystems.co.jp/news/info/vulner20231002.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de path traversal en el firmware ACERA 1320 versión 01.26 y anteriores, y en el firmware ACERA 1310 versión 01.26 y anteriores permite que un atacante autenticado adyacente a la red altere información crítica, como archivos del sistema, mediante el envío de una solicitud especialmente manipulada. Se ven afectados cuando se ejecutan en modo ST (Standalone)."
    }
  ],
  "lastModified": "2026-06-17T06:26:06.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FFEB8A0-F2DE-4C34-8C93-BDC2D903BE64",
              "versionEndIncluding": "01.26"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D97D14B5-1763-44C0-8EED-A3F787A97A8C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F94D3C1-940A-4A09-B99B-9BB79B73EA63",
              "versionEndIncluding": "01.26"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "09DD97A0-77E2-4BC6-A8EC-7BEF65B75E0C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}