CVE-2023-28392

Vulnerability

CVE-2023-28392 is an OS command injection vulnerability (CWE-78) in the web management interface of Inaba Denki Sangyo Wi-Fi AP UNIT products. Affected models include AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier [1][2].

Exploitation

An authenticated attacker with administrative privileges can exploit this vulnerability by sending a specially crafted request to the web UI. No user interaction or network position other than network access to the management interface is required. The attacker must have valid admin credentials [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands on the device with the privileges of the web server process, typically root. This leads to full compromise of confidentiality, integrity, and availability of the affected unit [1][2].

Mitigation

These products are end-of-life (EOL) and no patches are available. The vendor recommends workarounds: change the default IP address, restrict web UI access to the front LAN port only, use MAC address filtering for wireless clients, configure VPN or IP filters to limit connections, operate behind a firewall, avoid accessing other websites while logged into the settings page, and clear browser saved passwords after use [1][2].