OS command injection in Inaba Denki Sangyo Co., Ltd. Wi-Fi AP UNIT
Priority LOW 35CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0088 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Inaba Denki Sangyo Co., Ltd. | Wi-Fi AP UNIT | AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier | — | No fix listed | CNA |
- Wi-Fi AP UNIT VendorInaba Denki Sangyo Co., Ltd. Affected AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:inaba:ac-wapu-300_firmware:*:*:*:*:*:*:*:* | up to 1.00_b07 | Vulnerable | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:h:inaba:ac-wapu-300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:o:inaba:ac-wapu-300-p_firmware:*:*:*:*:*:*:*:* | up to 1.00_b08p | Vulnerable | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:h:inaba:ac-wapu-300-p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:o:inaba:ac-wapum-300_firmware:*:*:*:*:*:*:*:* | up to 1.00_b07 | Vulnerable | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:h:inaba:ac-wapum-300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:o:inaba:ac-wapum-300-p_firmware:*:*:*:*:*:*:*:* | up to 1.00_b08p | Vulnerable | Inaba Denki Sangyo Co., Ltd. |
| cpe:2.3:h:inaba:ac-wapum-300-p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Inaba Denki Sangyo Co., Ltd. |
- cpe:2.3:o:inaba:ac-wapu-300_firmware:*:*:*:*:*:*:*:* Versions up to 1.00_b07 Vulnerable ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:h:inaba:ac-wapu-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:o:inaba:ac-wapu-300-p_firmware:*:*:*:*:*:*:*:* Versions up to 1.00_b08p Vulnerable ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:h:inaba:ac-wapu-300-p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:o:inaba:ac-wapum-300_firmware:*:*:*:*:*:*:*:* Versions up to 1.00_b07 Vulnerable ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:h:inaba:ac-wapum-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:o:inaba:ac-wapum-300-p_firmware:*:*:*:*:*:*:*:* Versions up to 1.00_b08p Vulnerable ·Inaba Denki Sangyo Co., Ltd.
- cpe:2.3:h:inaba:ac-wapum-300-p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Inaba Denki Sangyo Co., Ltd.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28392
- 2026-10-03 Alias added: GHSA-f7v2-mxxv-9w4g
References
Advisory 2
- https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf
- https://jvn.jp/en/vu/JVNVU98968780/
More Inaba Denki Sangyo Co., Ltd. Ac-wapu-300-p Firmware vulnerabilities
- TI-2023-14906 Missing authentication in Inaba Denki Sangyo Co., Ltd. Wi-Fi AP UNIT CVSS 3.1HIGH 7.5
- TI-2023-14908 OS command injection in Inaba Denki Sangyo Co., Ltd. Wi-Fi AP UNIT CVSS 3.1HIGH 7.2
Sources
- CVE-2023-28392 · CVE Program
- CVE-2023-28392 · NVD
- FIRST EPSS
- GHSA-f7v2-mxxv-9w4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences