Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command…
Priority MEDIUM 47CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.
Summary
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0383 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:korenix:jetwave_2212g_firmware:1.3.t:*:*:*:*:*:*:* | 1.3.t | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2212g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2212x_firmware:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2212x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2212s_firmware:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2212s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2211c_firmware:*:*:*:*:*:*:*:* | before 1.6 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2211c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2411_firmware:*:*:*:*:*:*:*:* | before 1.5 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2411:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
- cpe:2.3:o:korenix:jetwave_2212g_firmware:1.3.t:*:*:*:*:*:*:* Versions 1.3.t Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2212g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2212x_firmware:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2212x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2212s_firmware:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2212s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2211c_firmware:*:*:*:*:*:*:*:* Versions before 1.6 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2211c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2411_firmware:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:korenix:jetwave_2111_firmware:*:*:*:*:*:*:*:* | before 1.5 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2111:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2411l_firmware:*:*:*:*:*:*:*:* | before 1.6 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2411l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2111l_firmware:*:*:*:*:*:*:*:* | before 1.6 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2111l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2414_firmware:*:*:*:*:*:*:*:* | before 1.4 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2414:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2114_firmware:*:*:*:*:*:*:*:* | before 1.4 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2114:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_2424_firmware:*:*:*:*:*:*:*:* | before 1.3 | Vulnerable | Korenix |
| cpe:2.3:o:korenix:jetwave_2460_firmware:*:*:*:*:*:*:*:* | before 1.6 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_2460:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_4221hp-e__firmware:*:*:*:*:*:*:*:* | up to 1.3.0 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_4221hp-e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_3220_v3__firmware:*:*:*:*:*:*:*:* | before 1.7 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_3220_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
| cpe:2.3:o:korenix:jetwave_3420_v3__firmware:*:*:*:*:*:*:*:* | before 1.7 | Vulnerable | Korenix |
| cpe:2.3:h:korenix:jetwave_3420_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Korenix |
- cpe:2.3:o:korenix:jetwave_2111_firmware:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2111:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2411l_firmware:*:*:*:*:*:*:*:* Versions before 1.6 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2411l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2111l_firmware:*:*:*:*:*:*:*:* Versions before 1.6 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2111l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2414_firmware:*:*:*:*:*:*:*:* Versions before 1.4 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2414:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2114_firmware:*:*:*:*:*:*:*:* Versions before 1.4 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2114:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_2424_firmware:*:*:*:*:*:*:*:* Versions before 1.3 Vulnerable ·Korenix
- cpe:2.3:o:korenix:jetwave_2460_firmware:*:*:*:*:*:*:*:* Versions before 1.6 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_2460:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_4221hp-e__firmware:*:*:*:*:*:*:*:* Versions up to 1.3.0 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_4221hp-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_3220_v3__firmware:*:*:*:*:*:*:*:* Versions before 1.7 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_3220_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
- cpe:2.3:o:korenix:jetwave_3420_v3__firmware:*:*:*:*:*:*:*:* Versions before 1.7 Vulnerable ·Korenix
- cpe:2.3:h:korenix:jetwave_3420_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Korenix
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-23295
- 2026-10-03 Alias added: GHSA-q74f-hvfr-7jqc
- 2026-10-21 EPSS moved to the 90th–95th percentile
References
More Korenix Jetwave 2111 Firmware vulnerabilities
- TI-2023-09174 Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command… CVSS 3.1HIGH 8.8
- TI-2023-09176 Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-23295 · CVE Program
- CVE-2023-23295 · NVD
- FIRST EPSS
- GHSA-q74f-hvfr-7jqc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences