title: Unauthenticated Firmware Upgrade
description: An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
problem types: CWE-347 Improper Verification of Cryptographic Signature
affected:
{
defaultStatus: affected
product: JetNet Series
vendor: Korenix
versions:
status: affected, version: firmware older than 2024/01
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: See:  https://www.beijerelectronics.com/en/support/Help___online?docId=69947 https://www.beijerelectronics.com/en/support/Help___online