Read the docs
TI-2023-20379 Aliases CVE-2023-39222GHSA-r3g8-4jx6-qh2v

OS command injection in FURUNO SYSTEMS Co.,Ltd. ACERA 1320

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows: ACERA 1320 firmware ver.01.26 and earlier, ACERA 1310 firmware ver.01.26 and earlier, ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01519 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FURUNO SYSTEMS Co.,Ltd.ACERA 1320firmware ver.01.26 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1310firmware ver.01.26 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1210firmware ver.02.36 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1150ifirmware ver.01.35 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1150wfirmware ver.01.35 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1110firmware ver.01.76 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1020firmware ver.01.86 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 1010firmware ver.01.86 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 950firmware ver.01.60 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 850Ffirmware ver.01.60 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 900firmware ver.02.54 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 850Mfirmware ver.02.06 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 810firmware ver.03.74 and earlier—No fix listedCNA
FURUNO SYSTEMS Co.,Ltd.ACERA 800STfirmware ver.07.35 and earlier—No fix listedCNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:*up to 01.26VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:*up to 01.26VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1210_firmware:*:*:*:*:*:*:*:*up to 02.36VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1210:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1150i_firmware:*:*:*:*:*:*:*:*up to 01.35VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1150i:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1150w_firmware:*:*:*:*:*:*:*:*up to 01.35VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1150w:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1310_firmware:*:*:*:*:*:*:*:* Versions up to 01.26 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1320_firmware:*:*:*:*:*:*:*:* Versions up to 01.26 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1210_firmware:*:*:*:*:*:*:*:* Versions up to 02.36 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1150i_firmware:*:*:*:*:*:*:*:* Versions up to 01.35 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1150i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1150w_firmware:*:*:*:*:*:*:*:* Versions up to 01.35 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1150w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:furunosystems:acera_1110_firmware:*:*:*:*:*:*:*:*up to 01.76VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1110:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1020_firmware:*:*:*:*:*:*:*:*up to 01.86VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1020:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_1010_firmware:*:*:*:*:*:*:*:*up to 01.86VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_1010:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_950_firmware:*:*:*:*:*:*:*:*up to 01.60VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_950:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_850f_firmware:*:*:*:*:*:*:*:*up to 01.60VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_850f:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_900_firmware:*:*:*:*:*:*:*:*up to 02.54VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_900:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_850m_firmware:*:*:*:*:*:*:*:*up to 02.06VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_850m:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_810_firmware:*:*:*:*:*:*:*:*up to 03.74VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_810:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:o:furunosystems:acera_800st_firmware:*:*:*:*:*:*:*:*up to 07.35VulnerableFURUNO SYSTEMS Co.,Ltd.
cpe:2.3:h:furunosystems:acera_800st:-:*:*:*:*:*:*:*not specified by NVDRunning onFURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1110_firmware:*:*:*:*:*:*:*:* Versions up to 01.76 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1020_firmware:*:*:*:*:*:*:*:* Versions up to 01.86 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_1010_firmware:*:*:*:*:*:*:*:* Versions up to 01.86 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_1010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_950_firmware:*:*:*:*:*:*:*:* Versions up to 01.60 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_850f_firmware:*:*:*:*:*:*:*:* Versions up to 01.60 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_850f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_900_firmware:*:*:*:*:*:*:*:* Versions up to 02.54 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_850m_firmware:*:*:*:*:*:*:*:* Versions up to 02.06 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_850m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_810_firmware:*:*:*:*:*:*:*:* Versions up to 03.74 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:o:furunosystems:acera_800st_firmware:*:*:*:*:*:*:*:* Versions up to 07.35 Vulnerable ·FURUNO SYSTEMS Co.,Ltd.
  • cpe:2.3:h:furunosystems:acera_800st:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·FURUNO SYSTEMS Co.,Ltd.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39222
  2. 2026-10-03 Alias added: GHSA-r3g8-4jx6-qh2v

References

Advisory 2

  • TI-2023-21709 Cross-site request forgery in FURUNO SYSTEMS Co.,Ltd. ACERA 1210 CVSS 3.1HIGH 8.8
  • TI-2023-20566 Cross-site scripting in FURUNO SYSTEMS Co.,Ltd. ACERA 1210 CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences