CVE-2023-5347

Executive Summary

CVE-2023-5347 is a critical Improper Verification of Cryptographic Signature vulnerability (CWE-347) in the update process of Korenix JetNet Series industrial switches. The flaw allows an unauthenticated, remote attacker to replace the entire operating system, including Trusted Executables, by bypassing signature verification during firmware updates. With a CVSS score of 9.8, this vulnerability poses a severe risk to operational technology (OT) environments, potentially enabling full device compromise, persistent backdoors, and disruption of industrial networks. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch; the only mitigation is upgrading to firmware version 2024/01 or later.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware in Korenix JetNet industrial switches, which are part of the OT supply chain. Organizations should verify the integrity of firmware updates and ensure they are obtained from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows complete takeover of the device without authentication, making it highly attractive for ransomware groups, nation-state actors, and OT-targeting threat actors.

Deep Dive & Mechanics

The vulnerability resides in the firmware update mechanism of Korenix JetNet devices. During a legitimate update, the device verifies a cryptographic signature on the firmware image to ensure it comes from a trusted source. Due to improper verification logic, an attacker can craft a malicious firmware image with a forged or missing signature that the device accepts as valid. Once the malicious image is applied, the attacker gains full control over the operating system, including the ability to modify Trusted Executables (e.g., bootloaders, kernel modules, and critical binaries). This can lead to persistent backdoors, data exfiltration, or disruption of network operations.

The attack is performed over the network, likely via the device’s web interface or management protocol, without requiring any prior authentication. The low attack complexity and lack of user interaction make it easily exploitable in exposed environments.

Vulnerable vs. Patched Code

No specific code snippets are available from public sources. However, the vulnerability is conceptually described as:

• Vulnerable: The firmware update process does not properly validate the cryptographic signature of the update image. It may accept images with invalid signatures, no signatures, or signatures from untrusted sources.
• Patched: Firmware version 2024/01 and later implement correct signature verification, ensuring only images signed with the vendor’s private key are accepted.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code exists, a red team would need to reverse-engineer the firmware update process. The following steps outline a potential exploitation approach:

1. Reconnaissance: Identify JetNet devices on the network using Shodan dorks (e.g., "JetNet").
2. Firmware Analysis: Obtain a legitimate firmware image from the vendor and analyze the update protocol (e.g., HTTP POST, TFTP, or custom protocol).
3. Signature Bypass: Identify the signature verification routine (e.g., in a binary like update_check). Modify the firmware image to include a backdoor (e.g., a reverse shell) and either strip the signature or replace it with a dummy value.
4. Delivery: Send the malicious firmware image to the device via the update interface.
5. Persistence: The backdoor will survive reboots and factory resets, as it replaces the OS.

Example (Conceptual):

# Assuming the update is via HTTP
curl -X POST -F "firmware=@malicious_firmware.bin" http://<target_ip>/update

Blue Team (Defense)

• Network Segmentation: Isolate JetNet devices on a dedicated OT VLAN with strict access controls.
• Firmware Integrity Monitoring: Use file integrity monitoring (FIM) tools to detect unauthorized changes to device firmware.
• Log Analysis: Monitor for unexpected firmware update requests or large binary uploads to device management interfaces.
• Honeypots: Deploy fake JetNet devices to detect scanning and exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual HTTP POST requests to /update or similar endpoints on JetNet devices.
  • Large binary files (firmware images) being uploaded to device management ports (e.g., 80, 443, 8080).
  • Outbound connections from JetNet devices to unknown IPs (e.g., for C2).
• File IOCs:
  • Modified firmware images with invalid or missing cryptographic signatures.
  • Presence of unauthorized binaries in /usr/bin, /sbin, or /etc/init.d.
• System IOCs:
  • Unexpected reboots or firmware version changes.
  • New user accounts or SSH keys added to the device.
  • Unusual processes running (e.g., reverse shells, cryptominers).

Detection Engineering

YARA Rule

rule CVE_2023_5347_JetNet_Firmware_Signature_Bypass {
    meta:
        description = "Detects malicious firmware images targeting Korenix JetNet devices with invalid signatures"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-5347"
    strings:
        $magic = { 4A 45 54 4E 45 54 } // "JETNET" header
        $sig_field = { 53 49 47 4E 41 54 55 52 45 } // "SIGNATURE"
        $invalid_sig = { 00 00 00 00 00 00 00 00 } // null signature
    condition:
        $magic at 0 and ($sig_field and $invalid_sig)
}

Sigma Rule

title: CVE-2023-5347 - Korenix JetNet Firmware Update Abuse
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to upload malicious firmware to Korenix JetNet devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/update'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate firmware updates from authorized administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-5347 - Korenix JetNet Firmware Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/update"; http_uri; content:"firmware"; http_client_body; pcre:"/Content-Disposition:\s*form-data;\s*name=\"firmware\"/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Action: Upgrade all Korenix JetNet devices to firmware version 2024/01 or later. If the upgrade is not possible, isolate the devices from untrusted networks.
• Network Controls: Restrict access to device management interfaces (e.g., web UI, SSH) to trusted IPs only. Use firewalls to block unauthorized inbound traffic.
• Monitoring: Enable logging on all JetNet devices and monitor for suspicious update attempts.
• Vendor Communication: Contact Korenix support for patch availability and workarounds.
• Compensating Controls: Implement network segmentation and intrusion detection systems (IDS) to detect exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence