Multiple Vulnerabilities in Inaba Denki Wi-Fi AP AC-WPS-11ac Series (RCE/CSRF/CVE-2025-25053)

Critical Vulnerability Information Vulnerability Overview Product: Inaba Denki Sangyo Wi-Fi AP UNIT 'AC-WPS-11ac series' Release Date: 2025/04/04 Update Date: 2025/04/04 Affected Product Versions AC-WPS-11ac v2.0.03P and earlier versions AC-WPS-11ac-P v2.0.03P and earlier versions AC-WPSM-11ac v2.0.03P and earlier versions AC-WPSM-11ac-P v2.0.03P and earlier versions AC-PD-WPS-11ac v2.0.03P and earlier versions AC-PD-WPS-11ac-P v2.0.03P and earlier versions Vulnerability Description 1. Improper Privilege Management (CWE-266) - CVSS: 4.3 - CVE: CVE-2025-23407 2. OS Command Injection (CWE-78) - CVSS: 8.8 - CVE: CVE-2025-25053, CVE-2025-27797 3. Cross-Site Request Forgery (CWE-352) - CVSS: 4.3 - CVE: CVE-2025-25056 4. Improper Restrictions on Rendered UI Layer or Framework (CWE-1021) - CVSS: 6.5 - CVE: CVE-2025-25213 5. Sensitive Information Transmitted in Plaintext (CWE-319) - CVSS: 5.9 - CVE: CVE-2025-27722 6. OS Command Injection in Specific Service (CWE-78) - CVSS: 9.8 - CVE: CVE-2025-27797 7. Authentication Information Disclosure in Specific Service (CWE-497) - CVSS: 7.5 - CVE: CVE-2025-27934 8. Critical Function Lacking Authentication (CWE-306) - CVSS: 7.5 - CVE: CVE-2025-29870 Impact Remote attackers may modify settings without proper authorization. Remote attackers may execute arbitrary OS commands. Users viewing malicious pages may perform unintended actions. Users clicking on malicious page content may perform unintended actions. Man-in-the-middle attacks may allow remote unauthenticated attackers to eavesdrop on communications and obtain authentication information. Remote unauthenticated attackers may obtain product authentication information. Remote unauthenticated attackers may obtain product configuration information including authentication data. Solution Update Firmware: Upgrade to the latest version. Apply Workarounds: Refer to information provided by the developer. Vendor Status Vendor: Inaba Denki Sangyo Co., Ltd. Link: [Multiple vulnerabilities in Wi-Fi AP UNIT [AC-WPS-11ac series] (PDF, Text in Japanese)](链接) References JPCERT/CC Addendum Vulnerability Analysis by JPCERT/CC Additional Information CVE IDs: - CVE-2025-23407 - CVE-2025-25053 - CVE-2025-25056 - CVE-2025-25213 - CVE-2025-27722 - CVE-2025-27797 - CVE-2025-27934 - CVE-2025-29870

Goal Reached Thanks to every supporter — we hit 100%!

Multiple Vulnerabilities in Inaba Denki Wi-Fi AP AC-WPS-11ac Series (RCE/CSRF/CVE-2025-25053)