CVE-2023-31196

Vulnerability

Missing authentication for a critical function (CWE-306) in Inaba Denki Sangyo Wi-Fi AP UNIT devices allows a remote unauthenticated attacker to obtain sensitive information. Affected products and versions are: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier [1].

Exploitation

An attacker does not need authentication or any special network position; exploiting the missing authentication for critical function can be done remotely over the network (AV:N, PR:N, UI:N) [1]. The attacker can directly access the unauthenticated critical function to retrieve sensitive data without user interaction.

Impact

Successful exploitation allows a remote unauthenticated attacker to obtain sensitive information of the affected products [1]. The CVSS v3 base score of 7.5 (High) indicates high confidentiality impact, with no impact on integrity or availability [1].

Mitigation

The developer states that these products are no longer supported. Users are recommended to apply workarounds to mitigate the impact, but no patch is available [1]. No fixed version has been released.