Vulnerability in Icom Sr-7100vn
CVE-2023-28390
Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a network-adjacent attacker with administrative privilege of the affected product to obtain an administrative privilege of the OS (Operating System). As a result, an arbitrary OS command may be executed.
EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Icom Sr-7100vn
- Icom Sr-7100vn\#31
- Icom Sr-7100vn\#31_firmware
- Icom Sr-7100vn_firmware
- Icom Incorporated Sr-7100vn — versions SR-7100VN firmware Ver.1.38(N) and earlier, and SR-7100VN #31 firmware Ver.1.21 and earlier
References
- vultures@jpcert.or.jp (Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-28390?
- CVE-2023-28390 is a medium-severity vulnerability in Icom Sr-7100vn. CVSS score: 6.8/10. Published 2023-05-23.
- How severe is CVE-2023-28390?
- Medium severity. CVSS v3 base score is 6.8 out of 10.