Medium severity · published Jan 24, 2024
CVE-2024-22366
Active debug code exists in Yamaha wireless LAN access point devices
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WLX202 · Yamaha Corporation
firmware Rev.16.00.18 and earlier · source: vendor
WL
WLX212 · Yamaha Corporation
firmware Rev.21.00.12 and earlier · source: vendor
WL
WLX222 · Yamaha Corporation
firmware Rev.24.00.03 and earlier · source: vendor
WL
WLX313 · Yamaha Corporation
firmware Rev.18.00.12 and earlier · source: vendor
WL
WLX413 · Yamaha Corporation
firmware Rev.22.00.05 and earlier · source: vendor
WF
Wlx202 Firmware · Yamaha
before 16.00.19 · source: NVD
WF
Wlx212 Firmware · Yamaha
before 21.00.13 · source: NVD
WF
Wlx222 Firmware · Yamaha
before 24.00.04 · source: NVD
WF
Wlx313 Firmware · Yamaha
before 18.00.13 · source: NVD
WF
Wlx413 Firmware · Yamaha
before 22.00.06 · source: NVD
