← Vulnerability feed

Vulnerability record · CVE-2021-39280 · published 6 February 2022

CVE-2021-39280: Korenix jetwave 2212s firmware vulnerability

Korenix · Jetwave 2212s Firmware

Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9.1, 2212G before 1.8, 3220 V3 before 1.5.1, 3420 V3 before 1.5.1, and 2311 through 2022-01-31.

8.8 CVSS 3.1 High EPSS 2.3% · top 17.1%
8.8CVSS 3.1 base score, v2 9.0
2.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9.1, 2212G before 1.8, 3220 V3 before 1.5.1, 3420 V3 before 1.5.1, and 2311 through 2022-01-31.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.htm Third Party AdvisoryVDB Entry
https://www.korenix.com/en/product/search.aspx?kw=JetWave ProductVendor Advisory
http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.htm Third Party AdvisoryVDB Entry
https://www.korenix.com/en/product/search.aspx?kw=JetWave ProductVendor Advisory

Track CVE-2021-39280 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-12504Pepperl-fuchs es7510-xt firmware vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 3.0%9.8CVE-2020-12501Pepperl-fuchs es7510-xt firmware hard-coded credentials vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 3.3%8.8CVE-2023-23295Korenix jetwave 2212g firmware command injection vulnerabilityKorenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the…EPSS 3.8%8.8CVE-2023-23294Korenix jetwave 2212g firmware command injection vulnerabilityKorenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter t…EPSS 2.7%7.2CVE-2020-12503Pepperl-fuchs es7510-xt firmware incorrect authorization vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 23%6.5CVE-2023-23296Korenix jetwave 2212g firmware uncontrolled resource consumption vulnerabilityKorenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.EPSS 0.80%

Source: NIST National Vulnerability Database (record CVE-2021-39280), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.