Command injection

2023-02-2323:15:00

PRIOn knowledge base

www.prio-n.com

korenix jetwave 4200

jetwave 3000

command injection

formsyscmd

nvd

execute commands as root

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.5%

JSON

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.

CPENameOperatorVersion
jetwave_2111_firmwarelt1.5
jetwave_2111l_firmwarelt1.6
jetwave_2114_firmwarelt1.4
jetwave_2211c_firmwarelt1.6
jetwave_2212g_firmwareeq1.3.116
jetwave_2212s_firmwareeq1.3.0
jetwave_2212x_firmwareeq1.3.0
jetwave_2411_firmwarelt1.5
jetwave_2411l_firmwarelt1.6
jetwave_2414_firmwarelt1.4

Name	Operator	Version
jetwave_2111_firmware	lt	1.5
jetwave_2111l_firmware	lt	1.6
jetwave_2114_firmware	lt	1.4
jetwave_2211c_firmware	lt	1.6
jetwave_2212g_firmware	eq	1.3.116
jetwave_2212s_firmware	eq	1.3.0
jetwave_2212x_firmware	eq	1.3.0
jetwave_2411_firmware	lt	1.5
jetwave_2411l_firmware	lt	1.6
jetwave_2414_firmware	lt	1.4