← Vulnerability feed

Vulnerability record · CVE-2023-23295 · published 23 February 2023

CVE-2023-23295: Korenix jetwave 2212g firmware command injection vulnerability

Korenix · Jetwave 2212g Firmware

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.

8.8 CVSS 3.1 High EPSS 3.8% · top 10.2% CWE-77 · Command injection
8.8CVSS 3.1 base score
3.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
15Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

15 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/ ExploitThird Party Advisory
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/ ExploitThird Party Advisory

Track CVE-2023-23295 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-12504Pepperl-fuchs es7510-xt firmware vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 3.0%9.8CVE-2020-12501Pepperl-fuchs es7510-xt firmware hard-coded credentials vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 3.3%8.8CVE-2023-23294Korenix jetwave 2212g firmware command injection vulnerabilityKorenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter t…EPSS 2.7%8.8CVE-2021-39280Korenix jetwave 2212s firmware vulnerabilityCertain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S b…EPSS 2.3%7.2CVE-2020-12503Pepperl-fuchs es7510-xt firmware incorrect authorization vulnerabilityImproper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES…EPSS 23%6.5CVE-2023-23296Korenix jetwave 2212g firmware uncontrolled resource consumption vulnerabilityKorenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.EPSS 0.80%8.1CVE-2016-3081Apache Struts 2 DMI method: prefix remote code executionApache Struts 2.3.19 through 2.3.28 permits remote code execution when Dynamic Method Invocation is enabled, because the method: prefix can be abused…KEVEPSS 95%analysed9.8CVE-2026-8037Progress LoadMaster API OS Command Injection RCEProgress LoadMaster (and related ADC products) contain an OS command injection flaw in multiple API command endpoints where unsanitized input is pass…KEVEPSS 77%analysed

Source: NIST National Vulnerability Database (record CVE-2023-23295), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.